DevThe Hacker Newsabout 3 hours ago
Windmill Flaw Lets Hackers Read Server Files
1 min read
A high-severity path traversal vulnerability (CVE-2026-29059, CVSS 7.5) in Windmill's get_log_file endpoint allows unauthenticated attackers to read arbitrary server files. Exploitation targets the SUPERADMIN_SECRET environment variable via /proc/1/environ. Windmill 1.603.3 fixed the issue. About 170 vulnerable systems across 24 countries were identified.
Level
Hype check
Tap to vote and see what everyone thinks.
