CVE-2026-29059

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.

• CWE-22

• https://github.com/windmill-labs/windmill/releases/tag/v1.603.3Release Notes
• https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwgVendor Advisory
• https://github.com/Chocapikk/WindfallProduct

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29053Ghost is a Node.js content management system. From version 0…9.8
• CVE-2026-29054Traefik is an HTTP reverse proxy and load balancer. From ver…7.5
• CVE-2026-29055Tandoor Recipes is an application for managing recipes, plan…5.3
• CVE-2026-29056Kanboard is project management software focused on Kanban me…8.8
• CVE-2026-29057Next.js is a React framework for building full-stack web app…6.5
• CVE-2026-29058AVideo is a video-sharing Platform software. Prior to versio…9.8
• CVE-2026-2906A security flaw has been discovered in Tenda HG9 300001138. …8.8
• CVE-2026-29060Gokapi is a self-hosted file sharing server with automatic e…5
• CVE-2026-29061Gokapi is a self-hosted file sharing server with automatic e…5.4
• CVE-2026-29062jackson-core contains core low-level incremental ("streaming…7.5
• CVE-2026-29063Immutable.js provides many Persistent Immutable data structu…9.8
• CVE-2026-29064Zarf is an Airgap Native Packager Manager for Kubernetes. Fr…8.2