CVE-2026-29059 | windmill-labs windmill up to 1.603.2 get_log_file filename path traversal

A vulnerability marked as critical has been reported in windmill-labs windmill up to 1.603.2. This affects the function get_log_file of the file /api/w/{workspace}/jobs_u/get_log_file/. This manipulation of the argument filename causes path traversal.

This vulnerability appears as CVE-2026-29059. The attack may be initiated remotely. There is no available exploit.

It is suggested to upgrade the affected component.