Windmill, an open‑source developer platform, contains a path‑traversal vulnerability in the get_log_file endpoint. An unauthenticated attacker can append '../' sequences to the filename parameter, causing the application to read arbitrary files from the server’s file system. This permits access to sensitive configuration files or credentials, resulting in a breach of confidentiality.

The vulnerability affects windmill-labs Windmill versions released before 1.603.3. Any deployment using a pre‑1.603.3 release with the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint is susceptible.

The CVSS score of 6.9 denotes moderate severity, while the EPSS of <1% indicates a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. An attacker can exploit the path traversal by sending a crafted GET request over the network without authentication, gaining read access to arbitrary server files and potentially exposing secrets or credentials.