/Vulnerability Library

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

CVE-2026-29059
Verified

Description

Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.

Severity

Critical

CVSS Score

10

Exploit Probability

2%

Affected Product

windmill

Published Date

June 3, 2026

Template Author

0x_akoko

CVE-2026-29059.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE ID:
cve-2026-29059
CWE ID:
cwe-22

References

https://github.com/Chocapikk/Windfallhttps://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/https://nvd.nist.gov/vuln/detail/CVE-2026-29059

Remediation Steps

Update to version 1.603.3 or later.