Loading vulnerability…
CVE-2026-29059 is an unauthenticated path traversal vulnerability in Windmill, an open-source developer platform for APIs, background jobs, workflows, and UIs. The flaw affects the get_log_file endpoint, where the filename parameter is concatenated into a server-side file path without proper sanitization or traversal prevention. By supplying traversal sequences, a remote attacker can cause the application to read files outside the intended log directory and return arbitrary file contents from the server. Reported affected Windmill versions are prior to 1.603.3, with multiple references indicating exposure across versions 1.309.0 through 1.603.2. The vulnerability primarily enables arbitrary file read, but in some deployments it can expose sensitive secrets or tokens that can be reused for administrative access and subsequent arbitrary code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a full exploit toolkit named Windfall targeting Windmill and Nextcloud Flow. It is not just a PoC: it contains standalone Python tooling, Metasploit modules, reusable Ruby mixins, PostgreSQL binary parsers, lab environments, and cleanup tooling. Because the repo includes Metasploit integration, the most relevant exploit files are the Metasploit modules under metasploit/modules/. The main offensive capabilities are: (1) unauthenticated path traversal via the Windmill jobs_u/get_log_file endpoint to read arbitrary files; (2) credential leakage from Flow config files, process environment, or local PostgreSQL files; (3) authenticated SQL injection in the folders/addowner endpoint to exfiltrate database data; (4) JWT forging using leaked jwt_secret to obtain superadmin privileges; (5) command execution through Windmill's legitimate jobs/run/preview API; and (6) separate Nextcloud takeover via leaked APP_SECRET using AppAPI and WebDAV/OCS endpoints. The Metasploit exploit/linux/http/windmill_path_traversal_rce.rb module chains unauthenticated file read with credential leakage and then uses the job preview endpoint for command execution. It supports standalone Windmill, Flow direct, and Flow proxy deployments, auto-detects deployment type, and can leak credentials from /nc_app_flow_data/windmill_users_config.json, /proc/*/environ, or PostgreSQL files. The exploit/linux/http/windmill_sqli_rce.rb module requires any valid Windmill account, exploits SQLi in /w/<workspace>/folders/addowner/<folder>, leaks jwt_secret and an admin email, forges a JWT, verifies super_admin access, and then executes commands via preview jobs. Auxiliary modules provide arbitrary file read and SQLi-based data dumping. The Nextcloud auxiliary/admin/http/nextcloud_appapi_shell.rb module is a post-compromise shell for full Nextcloud control once APP_SECRET is obtained. Repository structure: top-level Python tools (windfall_afr.py, windfall_sqli.py, windfall_nc_pivot.py, nc_appapi.py, windfall.py) implement similar chains outside Metasploit; metasploit/lib/ contains reusable Windmill/Nextcloud HTTP mixins and a custom Rex::Proto::PostgreSQL parser for reading raw PostgreSQL heap files; metasploit/modules/ contains the actual exploit and auxiliary modules; labs/ contains Docker-based vulnerable environments for Windmill standalone, Windmill all-in-one, PostgreSQL multiversion testing, and Nextcloud Flow; ghost_cleanup.py is an anti-forensics helper that connects to PostgreSQL over Unix socket or TCP and deletes job records using a self-destructing trigger. Overall, this is a mature, operational exploit framework with customizable payload delivery, multiple fallback credential leak paths, deployment auto-detection, and post-exploitation cleanup support.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windmill vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
The content only references CVE-2026-29059 in what appears to be a pull request or conversation title, without describing the vulnerability, affected product, impact, or technical details.
An unauthenticated path traversal vulnerability in Windmill's get_log_file endpoint that allows arbitrary file read and, when SUPERADMIN_SECRET is configured and exposed, can enable superadmin authentication and arbitrary code execution via the job preview API.
A Windmill vulnerability involving unauthenticated path traversal that can enable arbitrary file read, credential leakage, PostgreSQL data dumping, and remote code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.