Windmill Developer Platform Flaws Expose Users to RCE Attacks, Proof-of-Concept Published

Critical vulnerabilities in the Windmill developer platform and Nextcloud Flow — notably an unauthenticated path traversal (CVE-2026-29059, CVSS 10.0) and an authenticated SQL injection — permit remote attackers to read sensitive files, escalate privileges, and achieve full system control; the public release of the “Windfall” exploit framework (which includes a trace-wiping "Ghost Mode") significantly increases immediate exploitation risk and requires urgent upgrades to Windmill 1.603.3 and Nextcloud Flow 1.3.0 and mitigation steps such as path sanitization, strict authentication, running containers non‑root, and blocking Docker socket access.