Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.
Exploits (1)
Scores
CVSS v3
7.5
EPSS
0.0002
EPSS Percentile
5.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lab Environment
Details
CWE
CWE-22
Status
published
Products (2)
windmill/windmill
< 1.603.3
windmill-labs/windmill
< 1.603.3
Published
Mar 06, 2026
Tracked Since
Mar 06, 2026