Unauthenticated Path Traversal Vulnerability in Windmill Developer Platform
CVE-2026-29059

6.9MEDIUM

Key Information:

Vendor

Windmill-labs

Status
Windmill
Vendor
CVE Published:
6 March 2026

What is CVE-2026-29059?

Windmill, an open-source developer platform designed for internal code management, is affected by an unauthenticated path traversal issue. This vulnerability exists in the get_log_file endpoint, where the filename parameter is improperly handled. By exploiting this flaw, attackers can construct malicious requests to access arbitrary files on the server using directory traversal sequences like ../, potentially exposing sensitive information. The issue has been addressed and resolved in version 1.603.3, and users are encouraged to upgrade promptly.

Affected Version(s)

windmill < 1.603.3

References

https://github.com/windmill-labs/windmill/security/adviso...
x_refsource_CONFIRM
https://github.com/windmill-labs/windmill/releases/tag/v1...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.