Affected Systems

Windmill open-source developer platform versions prior to 1.603.3. The vulnerability affects the "get_log_file" endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}). Approximately 170 vulnerable systems identified across 24 countries.

Exploitation Status

Active exploitation confirmed in the wild. VulnCheck reports attackers targeting the get_log_file endpoint to extract /etc/passwd and other sensitive files. Exploitation observed against both direct Windmill endpoints and Nextcloud proxy paths.

Business Impact

Unauthenticated attackers can read arbitrary server files via path traversal using ../ sequences. Primary risk is exposure of SUPERADMIN_SECRET environment variable via /proc/1/environ, which enables superadmin authentication and arbitrary code execution through job preview API. For instances without SUPERADMIN_SECRET (default configuration), impact limited to arbitrary file read including credentials, configuration files, and system information.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade Windmill to version 1.603.3 or later, released January 2026, which adds filename parameter sanitization
  • Audit server logs for suspicious requests to /api/w/*/jobs_u/get_log_file/* endpoints containing ../ sequences or attempts to access /proc/1/environ or /etc/passwd
  • If SUPERADMIN_SECRET is configured, rotate the secret immediately after patching and review job preview API logs for unauthorized superadmin authentication attempts
  • For systems that cannot be immediately patched, implement WAF rules to block requests containing path traversal patterns (../) in the get_log_file endpoint filename parameter
  • Verify no unauthorized file access occurred by reviewing application logs and checking for anomalous access to sensitive files between January 2026 (patch release) and present