Windmill < 1.603.3 - Unauthenticated Path Traversal via Get Log File Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-29059. PoCs published by Chocapikk. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a sophisticated exploit framework for CVE-2026-29059, targeting unauthenticated path traversal in Windmill and Nextcloud Flow, leading to credential leaks and remote code execution. The exploit includes Metasploit modules, Docker labs for testing, and detailed documentation.
Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.
Exploits (1)
This repository contains a sophisticated exploit framework for CVE-2026-29059, targeting unauthenticated path traversal in Windmill and Nextcloud Flow, leading to credential leaks and remote code execution. The exploit includes Metasploit modules, Docker labs for testing, and detailed documentation.
Nuclei Templates (1)
http.html:"Windmill" http.html:"svelte-global-loader"
app="Windmill"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N