CVE-2026-29059: Windmill | defend.network

What is CVE-2026-29059?

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.

CVSS7.5 NVD 3.1

SeverityHIGH

Exploitation In the wild

EPSS3% · P84

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWECWE-22

NVD published2026-03-06

NVD last modified2026-06-17

Timeline

2026-03-06Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated
2026-07-23First covered in a defend.network daily briefing

Affected product

Windmill

Remediation Steps

Apply the vendor patch for Windmill to remediate the unauthenticated path traversal in the get_log_file endpoint
Restrict access to the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint to authenticated users only
Monitor logs for evidence of exploitation attempts targeting the vulnerable endpoint
Review any logs or files accessed through this endpoint during the period before patching

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of July 2026 (July 20 – 26)
Ubuntu, WordPress, Adobe critical flaws under active exploitation; CISA KEV adds four CVEs (2026-07-23)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.