Hackers are actively exploiting a high-severity path traversal flaw in the open-source Windmill developer platform, with VulnCheck saying it has identified about 170 vulnerable systems in 24 countries and observed attacks aimed at reading files such as CVE-2026-29059 through the platform’s log file endpoint.
KEY FACTS
- Vulnerability CVE-2026-29059 affects Windmill’s unauthenticated get_log_file endpoint.
- Impact The bug allows directory traversal and arbitrary file reads on the server.
- Exposure VulnCheck identified about 170 vulnerable systems across 24 countries.
- Fix Windmill 1.603.3 added sanitization checks to block traversal attempts.
- Targeting Attackers have tried to extract /etc/passwd and other sensitive data.
The vulnerability affects the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint. The advisory from Windmill said the filename value is joined into a file path without sanitization, which lets an attacker use ../ sequences to read arbitrary files.
The same advisory said the most sensitive value that could be exposed is the SUPERADMIN_SECRET environment variable, which can be read through /proc/1/environ if it is set. Windmill said that secret can act as a Bearer token for superadmin access and code execution through the job preview API, although it is not enabled by default.
VulnCheck said exploitation has focused on Windmill’s endpoint and a Nextcloud proxy path. The company said observed attempts included requests for /etc/passwd and other checks for server content. The issue was addressed in January 2026 in Windmill 1.603.3.
The disclosure came as CISA added four flaws to its Known Exploited Vulnerabilities catalog, including two WordPress issues, a DD-WRT buffer overflow and an unauthenticated Langflow remote code execution flaw. Separately, VulnCheck and other researchers said public proof-of-concept code and broad attack activity have increased the chances of follow-on exploitation.
WHY IT MATTERS
Exposed Windmill instances can be used to read server files, and in some configurations the flaw may help attackers reach higher privileges. Organizations running the platform are being urged to patch quickly and check for signs of file-read attempts.