Chocapikk/Windfall

PoC

Windfall - Unauthenticated RCE exploit chain for Windmill & Nextcloud Flow (CVE-2026-29059). Path traversal + credential leak + PostgreSQL heap dump + Nextcloud AppAPI takeover.

view exploit source poc_in_githubauthor Chocapikkpublished 2026-01-11catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-29059US	high7.5	3.01% (87th)	Exploit	2026-03-06
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan