Hackers Exploit Unpatched Windmill Path Traversal Flaw CVE-2026-29059 to Read Server Files

A high-severity path traversal vulnerability in the open-source developer platform Windmill, tracked as CVE-2026-29059 (CVSS 7.5), is under active exploitation. The flaw resides in the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint, where the filename parameter is concatenated into a file path without sanitization, allowing unauthenticated attackers to read arbitrary server files using ../ sequences.

According to VulnCheck, the primary sensitive value exposed is the SUPERADMIN_SECRET environment variable, readable via /proc/1/environ. When set, this secret can be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API. However, SUPERADMIN_SECRET is not set by default; for standalone instances without it, the impact is limited to arbitrary file read.

The issue was patched in Windmill 1.603.3 (January 2026) by adding sanitization checks. VulnCheck researcher Valentin Lobstein discovered and reported the flaw. Exploitation has targeted the get_log_file endpoint to extract /etc/passwd contents. Caitlin Condon, VP of security research at VulnCheck, noted exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path. Approximately 170 vulnerable systems across 24 countries have been identified.

Separately, CISA added four flaws to its Known Exploited Vulnerabilities catalog: two WordPress bugs (CVE-2026-60137, CVE-2026-63030) collectively called wp2shell, a stack-based buffer overflow in DD-WRT (CVE-2021-27137), and an unauthenticated remote code execution in Langflow (CVE-2026-0770). Wordfence described wp2shell as one of the most significant WordPress Core security events in recent years, with unauthenticated reachability, no plugin requirement, and public proof-of-concept exploits. Attack data shows threat actors exploiting REST API batch request route-confusion and unauthenticated SQL injection to achieve code execution.

For CVE-2026-0770, KEVIntel’s Ryan Dewhurst reported 137 exploitation attempts from 46 unique IPs across 17 countries since June 27, 2026. Payloads include base command checks, /etc/passwd extraction, AWS credential access, environment variable collection, malware downloads, and shell script execution for second-stage payloads. FCEB agencies must remediate by July 24, 2026.