A woman was killed as she leaned out of a train window below an inadequate warning sign, a report said.
Bethan Roper, 28, was hit in the head by a tree branch while on board a Great Western Railway (GWR) service travelling at about 75mph (120km/h) near Twerton, Bath.
The Rail Accident Investigation Branch (RAIB) also noted trees along the route had not been inspected since 2009.
Signs around the window were updated after Ms Roper's death.
The investigation said Ms Roper was returning to Penarth, South Wales, from Bath Spa station on 1 December 2018.
She was with friends, and the RAIB said it believed "at least one other friend leant out of the window before [Ms Roper]".
Witnesses told investigators Ms Roper had her head out of the window for a few seconds "before falling back into the vestibule".
Despite the efforts of other passengers, including some with medical training, she was pronounced dead at Bristol station, the report said.
The RAIB said the doors of the London Paddington to Exeter service were fitted with an opening window to enable passengers to open the door at stations.
It said a warning sign above the droplight window met industry guidance but "did not adequately convey the level of risk".
Investigators claimed the use of the word "caution" suggested that leaning out the window could be done safely if care was taken.
They said it was much smaller than other surrounding signs, and red, not yellow, would have been a more appropriate background colour for conveying danger.
GWR had completed a risk assessment of its droplight windows after an earlier passenger death,
It had planned to install enhanced warning signs by May 2018, but this had not happened by the time of Ms Roper's death, investigators found.
GWR told investigators it did not meet its schedule as two staff members involved in the task left the company and a system which tracks pieces of work failed.
The RAIB also noted that Network Rail, responsible for managing lineside vegetation, had not undertaken a tree inspection of the area since 2009 and this was "possibly causal to the accident".
An inspection of the tree after the accident reported the stem was in "poor health" growing from a decayed stump.
The arboricultural report said the tree had been "in hazardous condition for several years, and prior to January 2018 at least three stems would have been clear threats to the railway".
Ms Roper worked for the Welsh Refugee Council charity and was chairman of Young Socialists Cardiff.
Her father, Adrian Roper, released a statement after her death saying his daughter "enjoyed life to the full whilst working tirelessly for a better world".
He said the Bethan Roper Trust for Refugees has been set up in her memory.