Windmill path traversal flaw exploited to read server files

A path traversal vulnerability in the open-source Windmill platform is under active exploitation, according to research from VulnCheck. The flaw, identified as CVE-2026-29059 with a severity score of 7.5 on the Common Vulnerability Scoring System (CVSS), lets an unauthenticated attacker read files anywhere on the server by sending specially crafted requests. This matters to site owners and IT teams because Windmill is a developer platform that can be exposed on the public internet, and the same technique can be repurposed to steal sensitive configuration data.

The issue exists in Windmill's get_log_file endpoint, a specific web address that can be called, located at /api/w/{workspace}/jobs_u/get_log_file/{filename}. The filename value is appended to a file path without being checked, so an attacker can insert ../ sequences to move outside the intended directory. The term path traversal refers to this trick of using ../, which in many computer systems means go up one folder, to escape a restricted area. Windmill's advisory, published in March 2026, notes that the most sensitive value an attacker can read is the SUPERADMIN_SECRET environment variable, a value stored in the server's running environment, through the file /proc/1/environ. If that secret is set, it can be used as a Bearer token, a small secret text that proves identity in web requests, to authenticate as a superadmin, the highest-privilege account, and then run arbitrary code through the job preview API. The advisory also says SUPERADMIN_SECRET is not configured by default, and for standalone Windmill installations without it, the impact is limited to arbitrary file reading. The vendor fixed this in Windmill 1.603.3, released in January 2026, by adding sanitization checks, which clean the input before using it, to the filename parameter to stop directory traversal.

VulnCheck credits its security researcher Valentin Lobstein with discovering and reporting the flaw. The company says observed exploitation attempts have targeted the get_log_file endpoint in order to pull the contents of /etc/passwd, a standard Linux file that lists user accounts. Caitlin Condon, vice president of security research at VulnCheck, said on LinkedIn that the firm has observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path. VulnCheck identified about 170 vulnerable systems exposed across 24 countries.

The Windmill issue is only one of several vulnerabilities that have moved into active attack. The U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, added four security flaws to its Known Exploited Vulnerabilities catalog, which lists bugs that federal agencies must fix on a schedule. Two of those are WordPress flaws tracked collectively as wp2shell, with identifiers CVE-2026-60137 and CVE-2026-63030. A stack-based buffer overflow in DD-WRT appears under CVE-2021-27137, and an unauthenticated remote code execution flaw in Langflow is tracked as CVE-2026-0770. Wordfence described wp2shell as one of the most significant WordPress Core security events in recent years, pointing to the combination of unauthenticated reachability, no need for a plugin or theme, a large global attack surface, a route to administrator access and code execution, and public proof-of-concept exploit availability, that is, example code showing the attack works. Attack data from Wordfence shows threat actors are sending requests that exploit a REST API batch request route-confusion issue, a set of web addresses applications use to talk to WordPress, and an unauthenticated SQL injection, a type of attack that slips database commands into a request, to reach code execution.

VulnCheck said it had verified more than two dozen unique proof-of-concept exploits targeting wp2shell as of July 19, 2026, and recommended that affected users update to a fixed version of WordPress immediately. The activity around Langflow is also measurable. KEVIntel's Ryan Dewhurst told The Hacker News that first in-the-wild attack efforts against CVE-2026-0770 were detected against its sensors on June 27, 2026. Since then, the company recorded 137 exploitation attempts from 46 unique attacker IP addresses associated with 17 countries. Seventy-five attempts, more than half of the activity, came from 20 attacker IP addresses during the last seven days. Observed payloads included basic command execution checks, attempts to read /etc/passwd or access AWS credentials, collection of environment variables, malware downloads using wget or curl, and shell script execution to install second-stage payloads. Dewhurst said the activity is not limited to vulnerability checks: while much of it involved commands such as id, whoami and reading /etc/passwd, the company also observed payloads attempting to download malware and obtain environment variables, AWS credentials and container metadata.

Federal Civilian Executive Branch agencies have been told to remediate these flaws by July 24, 2026. For ordinary website owners, the practical takeaway is that exposed developer tools and unpatched content management systems can be found and attacked quickly. For WordPress site owners, a managed WordPress hosting plan such as AEU Hosting is secured end to end and can reduce the burden of applying core updates after events like wp2shell. Applying patches early remains the most reliable defense.