importantSYS.SOURCE: The Hacker News• 2026-07-22T18:06:36+05:30

CVE-2026-29059: Unauthenticated Path Traversal in Windmill Allows Arbitrary File Access

#vulnerability #web security #path traversal #server files

A high-severity path traversal vulnerability (CVE-2026-29059) in Windmill's 'get_log_file' endpoint allows unauthenticated attackers to read arbitrary server files, including sensitive environment variables like SUPERADMIN_SECRET, which could enable superadmin access and code execution. The flaw was patched in version 1.603.3 but remains active in exploited systems worldwide.

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.

The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}").

"The filename parameter is concatenated into

Read original article

*** END OF TRANSMISSION ***

> SCIENCE CORPORATION'S PRIMA VISION-CHIP RECEIVES EU MEDICAL DEVICE APPROVAL > YOPE SECURES $12.3M FOR ALGORITHM-FREE, AD-FREE PRIVATE SOCIAL NETWORK > CRITICAL UBUNTU SNAP-CONFINE VULNERABILITY (CVE-2026-8933) ENABLES LOCAL ROOT ACCESS VIA RACE CONDITIONS > MENLO VENTURES' MATT MURPHY ON ANTHROPIC'S STRATEGIC GROWTH DRIVERS BEYOND MODEL CAPABILITIES > MONDAY.COM RESTRUCTURES WORKFORCE TO PRIORITIZE AI DEVELOPMENT > ANALYSIS OF TERRENCE TAO'S DISCUSSION ON JACOBIAN CONJECTURE COUNTEREXAMPLE VIA CHATGPT > GIGATOKEN: HIGH-SPEED LANGUAGE MODEL TOKENIZATION AT GB/S > TESTING AI LAB OPTIMIZATION FOR PELICAN-ON-BICYCLE BENCHMARK > GOOGLE UNVEILS NATIVE IPHONE-TO-ANDROID MIGRATION FEATURE IN ANDROID 17 > INTERACTIVE WEB-SWING EXPERIENCE IN MIDTOWN MANHATTAN> SCIENCE CORPORATION'S PRIMA VISION-CHIP RECEIVES EU MEDICAL DEVICE APPROVAL > YOPE SECURES $12.3M FOR ALGORITHM-FREE, AD-FREE PRIVATE SOCIAL NETWORK > CRITICAL UBUNTU SNAP-CONFINE VULNERABILITY (CVE-2026-8933) ENABLES LOCAL ROOT ACCESS VIA RACE CONDITIONS > MENLO VENTURES' MATT MURPHY ON ANTHROPIC'S STRATEGIC GROWTH DRIVERS BEYOND MODEL CAPABILITIES > MONDAY.COM RESTRUCTURES WORKFORCE TO PRIORITIZE AI DEVELOPMENT > ANALYSIS OF TERRENCE TAO'S DISCUSSION ON JACOBIAN CONJECTURE COUNTEREXAMPLE VIA CHATGPT > GIGATOKEN: HIGH-SPEED LANGUAGE MODEL TOKENIZATION AT GB/S > TESTING AI LAB OPTIMIZATION FOR PELICAN-ON-BICYCLE BENCHMARK > GOOGLE UNVEILS NATIVE IPHONE-TO-ANDROID MIGRATION FEATURE IN ANDROID 17 > INTERACTIVE WEB-SWING EXPERIENCE IN MIDTOWN MANHATTAN