Skip to main content

Windmill CVE-2026-29059

MEDIUM
Path Traversal (CWE-22)
2026-03-06 security-advisories@github.com
Path Traversal Windmill
6.9
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 06, 2026 - 08:16 nvd
MEDIUM 6.9

DescriptionGitHub Advisory

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.

Articles & Coverage 1

POC CVE-2026-29059: Unauthenticated RCE in Windmill & Nextcloud Flow via Path Traversal Apr 07, 2026

AnalysisAI

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})".

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects workflows and UIs.. Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.

RemediationAI

Fixed in version 1.603.3.. Validate and sanitize file path inputs. Use allowlists.

More in Windmill

View all
CVE-2022-31519 CRITICAL POC
9.3 Jul 11

The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file fun
CVE-2026-22683 HIGH POC
8.7 Apr 07

Authorization bypass in Windmill 1.56.0-1.614.0 enables Operator role users to escalate privileges to remote code execut
CVE-2026-47107 HIGH
8.6 May 19

Cross-tenant DNS and TLS poisoning in Windmill versions prior to 1.703.2 allows authenticated low-privilege users to wri
CVE-2026-33881 HIGH
7.3 Mar 27

JavaScript code injection in Windmill's NativeTS executor allows workspace administrators to achieve remote code executi
CVE-2026-26964 LOW
2.7 Feb 20

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.63

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Same technique Path Traversal

View all
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5
CVE-2022-27925 HIGH POC
7.2
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2024-41713 CRITICAL POC
9.1
CVE-2016-0752 HIGH POC
7.5

Share

CVE-2026-29059 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy