Hackers Exploit Windmill Flaw to Read Server Files

A high-severity security vulnerability affecting the open-source developer platform Windmill is currently being actively exploited by malicious actors, according to VulnCheck. The vulnerability, identified as CVE-2026-29059 with a CVSS score of 7.5, allows for unauthenticated path traversal. This flaw specifically impacts Windmill's "get_log_file" endpoint, located at "/api/w/{workspace}/jobs_u/get_log_file/{filename}".

The "filename" parameter within this endpoint is directly concatenated into a path without proper sanitization. This means an attacker can manipulate the "filename" parameter to include directory traversal sequences, such as "../", enabling them to access files outside of the intended log directory. Successful exploitation grants attackers the ability to read arbitrary files from the Windmill server, potentially exposing sensitive data, configuration files, or source code.

VulnCheck's analysis indicates that this vulnerability has moved beyond theoretical discovery and is now being actively leveraged in real-world attacks. The platform's open-source nature means that its code is publicly available, which can accelerate the discovery and exploitation of such flaws by attackers. Organizations utilizing Windmill are advised to review their security configurations and apply any available patches or workarounds to mitigate the risk of unauthorized data access.

While specific details of the ongoing exploitation campaigns, such as the types of files targeted or the ultimate goals of the attackers, were not immediately disclosed by VulnCheck, the severity of the vulnerability underscores the importance of prompt security updates. The unauthenticated nature of the exploit means that any Windmill instance exposed to the internet without proper access controls is potentially at risk. Further details on the technical aspects of the exploit and recommended mitigation strategies are expected to be released.