{"repro_id":"REPRO-2026-00132","version":2,"title":"ShowDoc Unauthenticated File Upload RCE via deprecated ThinkPHP syntax","repro_type":"security","status":"published","severity":"critical","description":"ShowDoc versions before 2.8.7 contain an unrestricted file upload vulnerability. Due to deprecated ThinkPHP 3.1 syntax ($upload->allowExts instead of $upload->exts), attackers bypass extension checks using angle bracket tricks (e.g., test.<>php) to upload PHP webshells. The endpoint /index.php?s=/home/page/uploadImg is accessible without authentication.","root_cause":"## Summary\nShowDoc v2.8.2 is vulnerable to unauthenticated file upload leading to code execution. The real endpoint `POST /index.php?s=/home/page/uploadImg` accepts a multipart file named `test.<>php`, stores it under `Public/Uploads`, and the uploaded PHP is executable. The bug is caused by deprecated ThinkPHP syntax (`$upload->allowExts`) being ignored, so extension allowlisting is not enforced in the effective upload path.\n\n## Impact\n- **Package/component affected:** `showdoc/showdoc`, `PageController::uploadImg()` and ThinkPHP upload handling (`ThinkPHP Upload->upload()`)\n- **Affected versions:** ShowDoc before 2.8.7 (runtime validated on v2.8.2)\n- **Risk level:** Critical\n- **Consequences:**\n  - Unauthenticated attacker can upload executable PHP\n  - Uploaded file is reachable from web path (`/Public/Uploads/...`)\n  - Remote code execution in application context\n\n## Root Cause\nIn vulnerable code, `uploadImg()` configures ThinkPHP upload with:\n- `$upload->allowExts = array('jpg','gif','png','jpeg');`\n- then `$info = $upload->upload();`\n\nOn ThinkPHP 3.2+, `allowExts` is deprecated/ignored and the active key is `exts`. Because of this mismatch, intended extension restrictions are ineffective in the vulnerable path. A crafted filename (`test.<>php`) bypasses the simple `.php` substring check and results in a saved `.php` payload.\n\n**Fix commits:**\n- `fb77dd4db88dc23f5e570fc95919ee882aca520a`: replaces `allowExts` with `exts` (upload blocked)\n- `e1cd02a3f98bb227c0599e7fa6b803ab1097597f`: adds early `return false` in `uploadImg()` (endpoint disabled)\n\n## Reproduction Steps\n1. Run `repro/reproduction_steps.sh`.\n2. The script:\n   - clones ShowDoc and checks out three revisions: vulnerable `v2.8.2`, fixed `fb77dd4`, fixed `e1cd02a`\n   - builds Docker runtime images (`php:7.4-apache`) for each revision\n   - initializes each instance via `install/non_interactive.php`\n   - sends real multipart POST to `/index.php?s=/home/page/uploadImg` with filename `test.<>php`\n   - for vulnerable revision, requests the uploaded PHP and verifies execution marker\n   - for fixed revisions, verifies upload rejection/disable behavior and absence of uploaded PHP\n3. Expected evidence:\n   - vulnerable upload response contains success JSON + uploaded `.php` URL\n   - vulnerable execution response contains `RCE_OK_1e08f13e8e4695e97fef6d9de3665be4`\n   - fb77 shows `上传文件后缀不允许` and no uploaded PHP\n   - e1cd returns empty response body and no uploaded PHP\n\n## Evidence\n- Execution logs:\n  - `logs/reproduction_run8.log`\n  - `logs/reproduction_run9.log`\n- Vulnerable artifacts:\n  - `repro/runtime_artifacts/http/vuln/upload_response.txt`\n  - `repro/runtime_artifacts/http/vuln/uploaded_php_files.txt`\n  - `repro/runtime_artifacts/http/vuln/webshell_exec_response.txt`\n  - `repro/runtime_artifacts/http/vuln/container.log`\n  - `repro/runtime_artifacts/http/vuln/controller_lines.txt`\n  - `repro/runtime_artifacts/http/vuln/controller_upload_flow.txt`\n- Fixed artifacts:\n  - `repro/runtime_artifacts/http/fb77/upload_response.txt`\n  - `repro/runtime_artifacts/http/fb77/uploaded_php_files.txt`\n  - `repro/runtime_artifacts/http/fb77/container.log`\n  - `repro/runtime_artifacts/http/e1cd/upload_response.txt`\n  - `repro/runtime_artifacts/http/e1cd/uploaded_php_files.txt`\n  - `repro/runtime_artifacts/http/e1cd/container.log`\n- Revision evidence:\n  - `repro/runtime_artifacts/http/vuln/revision.txt`\n  - `repro/runtime_artifacts/http/fb77/revision.txt`\n  - `repro/runtime_artifacts/http/e1cd/revision.txt`\n- Summary artifact:\n  - `repro/runtime_artifacts/http/summary.txt`\n\n## Recommendations / Next Steps\n- Upgrade to a fixed release (>= 2.8.7) or include both fixes (`fb77dd4` and `e1cd02a`).\n- Keep upload endpoint authenticated or disabled if not required.\n- Enforce strict extension/MIME checks with current framework API (`exts`) and add server-level execution restrictions in upload directories.\n- Add regression tests for tricky filenames like `test.<>php` and other extension obfuscation inputs.\n\n## Additional Notes\n- **Idempotency:** confirmed. `repro/reproduction_steps.sh` was run twice consecutively (`reproduction_run8.log`, `reproduction_run9.log`) with successful reproduction and consistent vulnerable-vs-fixed behavior.\n- **Limitation:** requires Docker availability in the execution environment.","cve_id":"CVE-2025-0520","source_url":"https://github.com/advisories/GHSA-6jmr-r7p6-f5wr","package":{"name":"showdoc/showdoc","ecosystem":"github","affected_versions":"ShowDoc versions before 2.8.7 (commonly referenced as <=2.8.6); Vulhub lab uses 2.8.2"},"reproduced_at":"2026-04-14T14:59:24.402943+00:00","duration_secs":8381.0,"tool_calls":526,"handoffs":4,"quality":{"idempotent_verified":false,"community_verifications":0},"published_at":"2026-04-14T14:59:26.284085+00:00","retracted":false,"artifacts":[{"path":"repro/rca_report.md","filename":"rca_report.md","size":4336,"category":"analysis"},{"path":"repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":10273,"category":"reproduction_script"},{"path":"vuln_variant/rca_report.md","filename":"rca_report.md","size":5587,"category":"analysis"},{"path":"vuln_variant/reproduction_steps.sh","filename":"reproduction_steps.sh","size":7771,"category":"reproduction_script"},{"path":"coding/proposed_fix.diff","filename":"proposed_fix.diff","size":917,"category":"patch"},{"path":"bundle/ticket.json","filename":"ticket.json","size":1975,"category":"other"},{"path":"bundle/repro/judge_review.json","filename":"judge_review.json","size":1029,"category":"other"},{"path":"bundle/AGENTS.repro.md","filename":"AGENTS.repro.md","size":770,"category":"documentation"},{"path":"bundle/ticket.md","filename":"ticket.md","size":1542,"category":"ticket"},{"path":"repro/runtime_manifest.json","filename":"runtime_manifest.json","size":1085,"category":"other"},{"path":"repro/runtime_artifacts/library_api_output.txt","filename":"library_api_output.txt","size":2361,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/controller_lines.txt","filename":"controller_lines.txt","size":207,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/healthcheck_http_code.txt","filename":"healthcheck_http_code.txt","size":4,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/container.log","filename":"container.log","size":809,"category":"log"},{"path":"repro/runtime_artifacts/http/fb77/upload_response.txt","filename":"upload_response.txt","size":1742,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/webshell_exec_response.txt","filename":"webshell_exec_response.txt","size":0,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/controller_upload_flow.txt","filename":"controller_upload_flow.txt","size":1943,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":0,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"repro/runtime_artifacts/http/fb77/request_metadata.txt","filename":"request_metadata.txt","size":115,"category":"other"},{"path":"repro/runtime_artifacts/http/summary.txt","filename":"summary.txt","size":745,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/controller_lines.txt","filename":"controller_lines.txt","size":212,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/healthcheck_http_code.txt","filename":"healthcheck_http_code.txt","size":4,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/container.log","filename":"container.log","size":937,"category":"log"},{"path":"repro/runtime_artifacts/http/vuln/upload_response.txt","filename":"upload_response.txt","size":459,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/webshell_exec_response.txt","filename":"webshell_exec_response.txt","size":213,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/controller_upload_flow.txt","filename":"controller_upload_flow.txt","size":1948,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":58,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"repro/runtime_artifacts/http/vuln/request_metadata.txt","filename":"request_metadata.txt","size":115,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/controller_lines.txt","filename":"controller_lines.txt","size":239,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/healthcheck_http_code.txt","filename":"healthcheck_http_code.txt","size":4,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/container.log","filename":"container.log","size":808,"category":"log"},{"path":"repro/runtime_artifacts/http/e1cd/upload_response.txt","filename":"upload_response.txt","size":347,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/webshell_exec_response.txt","filename":"webshell_exec_response.txt","size":0,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/controller_upload_flow.txt","filename":"controller_upload_flow.txt","size":1903,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":0,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"repro/runtime_artifacts/http/e1cd/request_metadata.txt","filename":"request_metadata.txt","size":115,"category":"other"},{"path":"repro/runtime_artifacts/library_api_success.txt","filename":"library_api_success.txt","size":5,"category":"other"},{"path":"repro/validation_verdict.json","filename":"validation_verdict.json","size":677,"category":"other"},{"path":"logs/clone_showdoc.log","filename":"clone_showdoc.log","size":58,"category":"log"},{"path":"logs/reproduction_run1.log","filename":"reproduction_run1.log","size":308,"category":"log"},{"path":"logs/docker_build_vuln.log","filename":"docker_build_vuln.log","size":871,"category":"log"},{"path":"logs/reproduction_run6.log","filename":"reproduction_run6.log","size":308,"category":"log"},{"path":"logs/reproduction_run3.log","filename":"reproduction_run3.log","size":308,"category":"log"},{"path":"logs/docker_build_fb77.log","filename":"docker_build_fb77.log","size":871,"category":"log"},{"path":"logs/git_checkout_vuln.log","filename":"git_checkout_vuln.log","size":577,"category":"log"},{"path":"logs/git_checkout_e1cd.log","filename":"git_checkout_e1cd.log","size":636,"category":"log"},{"path":"logs/reproduction_run4.log","filename":"reproduction_run4.log","size":308,"category":"log"},{"path":"logs/reproduction_run7.log","filename":"reproduction_run7.log","size":308,"category":"log"},{"path":"logs/reproduction_run2.log","filename":"reproduction_run2.log","size":308,"category":"log"},{"path":"logs/git_checkout_fb77.log","filename":"git_checkout_fb77.log","size":635,"category":"log"},{"path":"logs/reproduction_run5.log","filename":"reproduction_run5.log","size":308,"category":"log"},{"path":"logs/phpserver_vuln.log","filename":"phpserver_vuln.log","size":973,"category":"log"},{"path":"logs/fetch_showdoc.log","filename":"fetch_showdoc.log","size":0,"category":"log"},{"path":"logs/reproduction_run8.log","filename":"reproduction_run8.log","size":308,"category":"log"},{"path":"logs/reproduction_run9.log","filename":"reproduction_run9.log","size":308,"category":"log"},{"path":"logs/docker_build_e1cd.log","filename":"docker_build_e1cd.log","size":871,"category":"log"},{"path":"vuln_variant/variant_manifest.json","filename":"variant_manifest.json","size":3248,"category":"other"},{"path":"vuln_variant/probe_login_passwords.sh","filename":"probe_login_passwords.sh","size":406,"category":"other"},{"path":"vuln_variant/runtime_manifest.json","filename":"runtime_manifest.json","size":1094,"category":"other"},{"path":"vuln_variant/probe_latest_head.sh","filename":"probe_latest_head.sh","size":3903,"category":"other"},{"path":"vuln_variant/probe_phtml_on_container.sh","filename":"probe_phtml_on_container.sh","size":2249,"category":"other"},{"path":"vuln_variant/probe_latest_php82.sh","filename":"probe_latest_php82.sh","size":3883,"category":"other"},{"path":"vuln_variant/source_identity.json","filename":"source_identity.json","size":848,"category":"other"},{"path":"vuln_variant/probe_upload_with_token.sh","filename":"probe_upload_with_token.sh","size":539,"category":"other"},{"path":"vuln_variant/patch_analysis.md","filename":"patch_analysis.md","size":3884,"category":"documentation"},{"path":"vuln_variant/quick_session_upload_probe.sh","filename":"quick_session_upload_probe.sh","size":1656,"category":"other"},{"path":"vuln_variant/seed_item_for_login.sh","filename":"seed_item_for_login.sh","size":1312,"category":"other"},{"path":"vuln_variant/probe_token_delivery_modes.sh","filename":"probe_token_delivery_modes.sh","size":1460,"category":"other"},{"path":"vuln_variant/probe_api_attachment.sh","filename":"probe_api_attachment.sh","size":2818,"category":"other"},{"path":"vuln_variant/validation_verdict.json","filename":"validation_verdict.json","size":3086,"category":"other"},{"path":"vuln_variant/root_cause_equivalence.json","filename":"root_cause_equivalence.json","size":959,"category":"other"},{"path":"logs/vuln_variant_e1cd_install_probe2.log","filename":"vuln_variant_e1cd_install_probe2.log","size":20,"category":"log"},{"path":"logs/vuln_variant_e1cd_login_probe.json","filename":"vuln_variant_e1cd_login_probe.json","size":93,"category":"other"},{"path":"logs/vuln_variant/phtml_token_prefix_test.txt","filename":"phtml_token_prefix_test.txt","size":38,"category":"other"},{"path":"logs/vuln_variant/probe_upload_token_cookie.txt","filename":"probe_upload_token_cookie.txt","size":347,"category":"other"},{"path":"logs/vuln_variant/probe_container_id.txt","filename":"probe_container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/probe_upload_xwww_token_only.txt","filename":"probe_upload_xwww_token_only.txt","size":347,"category":"other"},{"path":"logs/vuln_variant/latest_php82_seed_item.txt","filename":"latest_php82_seed_item.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/latest_upload_tokenform.txt","filename":"latest_upload_tokenform.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/quick_vuln_login.json","filename":"quick_vuln_login.json","size":26,"category":"other"},{"path":"logs/vuln_variant/latest_uploaded_phtml.txt","filename":"latest_uploaded_phtml.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/probe_login_http___127_0_0_1_index_php_s__Api_User_login_showdoc.json","filename":"probe_login_http___127_0_0_1_index_php_s__Api_User_login_showdoc.json","size":93,"category":"other"},{"path":"logs/vuln_variant/reproduction_run1.log","filename":"reproduction_run1.log","size":42,"category":"log"},{"path":"logs/vuln_variant/probe_login_http___127_0_0_1_server_index_php_s__Api_User_login_admin.json","filename":"probe_login_http___127_0_0_1_server_index_php_s__Api_User_login_admin.json","size":93,"category":"other"},{"path":"logs/vuln_variant/probe_install.txt","filename":"probe_install.txt","size":20,"category":"other"},{"path":"logs/vuln_variant/probe_upload_with_token.txt","filename":"probe_upload_with_token.txt","size":440,"category":"other"},{"path":"logs/vuln_variant/latest_php82_install.txt","filename":"latest_php82_install.txt","size":16,"category":"other"},{"path":"logs/vuln_variant/probe_item_index_with_token.txt","filename":"probe_item_index_with_token.txt","size":572,"category":"other"},{"path":"logs/vuln_variant/phtml_files_e1cd.txt","filename":"phtml_files_e1cd.txt","size":60,"category":"other"},{"path":"logs/vuln_variant/phtml_install.txt","filename":"phtml_install.txt","size":134,"category":"other"},{"path":"logs/vuln_variant/latest_health.txt","filename":"latest_health.txt","size":4,"category":"other"},{"path":"logs/vuln_variant/latest_seed_item.txt","filename":"latest_seed_item.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/fb77/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/fb77/login_user_token.txt","filename":"login_user_token.txt","size":64,"category":"other"},{"path":"logs/vuln_variant/fb77/attempt1_page_phtml.txt","filename":"attempt1_page_phtml.txt","size":451,"category":"other"},{"path":"logs/vuln_variant/fb77/health_http_code.txt","filename":"health_http_code.txt","size":4,"category":"other"},{"path":"logs/vuln_variant/fb77/controller_lines.txt","filename":"controller_lines.txt","size":1946,"category":"other"},{"path":"logs/vuln_variant/fb77/seed_item_output.txt","filename":"seed_item_output.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/fb77/uploaded_phtml_files.txt","filename":"uploaded_phtml_files.txt","size":120,"category":"other"},{"path":"logs/vuln_variant/fb77/container.log","filename":"container.log","size":1193,"category":"log"},{"path":"logs/vuln_variant/fb77/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/fb77/attempt3_attachment_phtml.txt","filename":"attempt3_attachment_phtml.txt","size":451,"category":"other"},{"path":"logs/vuln_variant/fb77/all_uploaded_files.txt","filename":"all_uploaded_files.txt","size":160,"category":"other"},{"path":"logs/vuln_variant/fb77/attempt2_page_angle_php.txt","filename":"attempt2_page_angle_php.txt","size":283,"category":"other"},{"path":"logs/vuln_variant/fb77/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/fb77/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"logs/vuln_variant/fb77/login_response.txt","filename":"login_response.txt","size":767,"category":"other"},{"path":"logs/vuln_variant/quick_uploaded_php_files.txt","filename":"quick_uploaded_php_files.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/probe_page_upload_files_e1cd.txt","filename":"probe_page_upload_files_e1cd.txt","size":120,"category":"other"},{"path":"logs/vuln_variant/quick_exec_response.txt","filename":"quick_exec_response.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/probe_upload_nicejpg_with_token_query.txt","filename":"probe_upload_nicejpg_with_token_query.txt","size":440,"category":"other"},{"path":"logs/vuln_variant/build_latestvv.log","filename":"build_latestvv.log","size":875,"category":"log"},{"path":"logs/vuln_variant/probe_upload_token_formfield.txt","filename":"probe_upload_token_formfield.txt","size":347,"category":"other"},{"path":"logs/vuln_variant/fixed_version.txt","filename":"fixed_version.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/probe_latest_head_stdout.txt","filename":"probe_latest_head_stdout.txt","size":5,"category":"other"},{"path":"logs/vuln_variant/quick_vuln_phtml_files.txt","filename":"quick_vuln_phtml_files.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/latest_php82_uploaded_phtml.txt","filename":"latest_php82_uploaded_phtml.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/probe_item_index_post_token.txt","filename":"probe_item_index_post_token.txt","size":572,"category":"other"},{"path":"logs/vuln_variant/probe_login_http___127_0_0_1_server_index_php_s__Api_User_login_showdoc.json","filename":"probe_login_http___127_0_0_1_server_index_php_s__Api_User_login_showdoc.json","size":93,"category":"other"},{"path":"logs/vuln_variant/latest_php82_container_id.txt","filename":"latest_php82_container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/phtml_seed_token.txt","filename":"phtml_seed_token.txt","size":164,"category":"other"},{"path":"logs/vuln_variant/probe_paths.txt","filename":"probe_paths.txt","size":296,"category":"other"},{"path":"logs/vuln_variant/latest_container_id.txt","filename":"latest_container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/vv-e1cd-test_container_tail.log","filename":"vv-e1cd-test_container_tail.log","size":3165,"category":"log"},{"path":"logs/vuln_variant/phtml_upload_formtoken_e1cd.txt","filename":"phtml_upload_formtoken_e1cd.txt","size":515,"category":"other"},{"path":"logs/vuln_variant/revision_matrix.txt","filename":"revision_matrix.txt","size":203,"category":"other"},{"path":"logs/vuln_variant/retry_probe_token_delivery_modes_stdout.txt","filename":"retry_probe_token_delivery_modes_stdout.txt","size":1201,"category":"other"},{"path":"logs/vuln_variant/quick_upload_response.txt","filename":"quick_upload_response.txt","size":283,"category":"other"},{"path":"logs/vuln_variant/latest_php82_revision.txt","filename":"latest_php82_revision.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/manual_php_exec_test.txt","filename":"manual_php_exec_test.txt","size":216,"category":"other"},{"path":"logs/vuln_variant/latest_version.txt","filename":"latest_version.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/retry_quick_session_upload_probe_stdout.txt","filename":"retry_quick_session_upload_probe_stdout.txt","size":1078,"category":"other"},{"path":"logs/vuln_variant/seed_item_for_login_stdout.txt","filename":"seed_item_for_login_stdout.txt","size":5,"category":"other"},{"path":"logs/vuln_variant/quick_vuln_upload.txt","filename":"quick_vuln_upload.txt","size":440,"category":"other"},{"path":"logs/vuln_variant/latest_upload_cookie.txt","filename":"latest_upload_cookie.txt","size":459,"category":"other"},{"path":"logs/vuln_variant/latest_php82_login.txt","filename":"latest_php82_login.txt","size":397,"category":"other"},{"path":"logs/vuln_variant/latest_php82_health.txt","filename":"latest_php82_health.txt","size":4,"category":"other"},{"path":"logs/vuln_variant/probe_token_from_login.txt","filename":"probe_token_from_login.txt","size":38,"category":"other"},{"path":"logs/vuln_variant/latest_php82_upload_tokenform.txt","filename":"latest_php82_upload_tokenform.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/summary.txt","filename":"summary.txt","size":519,"category":"other"},{"path":"logs/vuln_variant/probe_login_http___127_0_0_1_index_php_s__Api_User_login_admin.json","filename":"probe_login_http___127_0_0_1_index_php_s__Api_User_login_admin.json","size":93,"category":"other"},{"path":"logs/vuln_variant/manual_vuln_cookie_phtml.txt","filename":"manual_vuln_cookie_phtml.txt","size":1037,"category":"other"},{"path":"logs/vuln_variant/quick_login_response.txt","filename":"quick_login_response.txt","size":767,"category":"other"},{"path":"logs/vuln_variant/probe_login_summary.txt","filename":"probe_login_summary.txt","size":1401,"category":"other"},{"path":"logs/vuln_variant/latest_ready.txt","filename":"latest_ready.txt","size":10,"category":"other"},{"path":"logs/vuln_variant/latest_build.log","filename":"latest_build.log","size":831,"category":"log"},{"path":"logs/vuln_variant/seed_item_count.txt","filename":"seed_item_count.txt","size":13,"category":"other"},{"path":"logs/vuln_variant/reproduction_run2.log","filename":"reproduction_run2.log","size":42,"category":"log"},{"path":"logs/vuln_variant/v2_8_2/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/login_user_token.txt","filename":"login_user_token.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/attempt1_page_phtml.txt","filename":"attempt1_page_phtml.txt","size":410,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/health_http_code.txt","filename":"health_http_code.txt","size":4,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/controller_lines.txt","filename":"controller_lines.txt","size":1697,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/seed_item_output.txt","filename":"seed_item_output.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/uploaded_phtml_files.txt","filename":"uploaded_phtml_files.txt","size":60,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/container.log","filename":"container.log","size":1193,"category":"log"},{"path":"logs/vuln_variant/v2_8_2/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/attempt3_attachment_phtml.txt","filename":"attempt3_attachment_phtml.txt","size":512,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/all_uploaded_files.txt","filename":"all_uploaded_files.txt","size":100,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/attempt2_page_angle_php.txt","filename":"attempt2_page_angle_php.txt","size":283,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"logs/vuln_variant/v2_8_2/login_response.txt","filename":"login_response.txt","size":540,"category":"other"},{"path":"logs/vuln_variant/latest_install.txt","filename":"latest_install.txt","size":16,"category":"other"},{"path":"logs/vuln_variant/probe_phtml_on_container_stdout.txt","filename":"probe_phtml_on_container_stdout.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/quick_install.txt","filename":"quick_install.txt","size":134,"category":"other"},{"path":"logs/vuln_variant/seed_install.txt","filename":"seed_install.txt","size":134,"category":"other"},{"path":"logs/vuln_variant/seed_item.txt","filename":"seed_item.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/phtml_exec_e1cd.txt","filename":"phtml_exec_e1cd.txt","size":258,"category":"other"},{"path":"logs/vuln_variant/latest_php82_upload_cookie.txt","filename":"latest_php82_upload_cookie.txt","size":336,"category":"other"},{"path":"logs/vuln_variant/quick_session_upload_probe_stdout.txt","filename":"quick_session_upload_probe_stdout.txt","size":962,"category":"other"},{"path":"logs/vuln_variant/latest_php82_token.txt","filename":"latest_php82_token.txt","size":1,"category":"other"},{"path":"logs/vuln_variant/probe_login_passwords.txt","filename":"probe_login_passwords.txt","size":1370,"category":"other"},{"path":"logs/vuln_variant/manual_extension_exec_matrix.txt","filename":"manual_extension_exec_matrix.txt","size":1512,"category":"other"},{"path":"logs/vuln_variant/e1cd/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"logs/vuln_variant/e1cd/login_user_token.txt","filename":"login_user_token.txt","size":64,"category":"other"},{"path":"logs/vuln_variant/e1cd/attempt1_page_phtml.txt","filename":"attempt1_page_phtml.txt","size":451,"category":"other"},{"path":"logs/vuln_variant/e1cd/health_http_code.txt","filename":"health_http_code.txt","size":4,"category":"other"},{"path":"logs/vuln_variant/e1cd/controller_lines.txt","filename":"controller_lines.txt","size":2052,"category":"other"},{"path":"logs/vuln_variant/e1cd/seed_item_output.txt","filename":"seed_item_output.txt","size":7,"category":"other"},{"path":"logs/vuln_variant/e1cd/uploaded_phtml_files.txt","filename":"uploaded_phtml_files.txt","size":120,"category":"other"},{"path":"logs/vuln_variant/e1cd/container.log","filename":"container.log","size":1193,"category":"log"},{"path":"logs/vuln_variant/e1cd/revision.txt","filename":"revision.txt","size":41,"category":"other"},{"path":"logs/vuln_variant/e1cd/attempt3_attachment_phtml.txt","filename":"attempt3_attachment_phtml.txt","size":451,"category":"other"},{"path":"logs/vuln_variant/e1cd/all_uploaded_files.txt","filename":"all_uploaded_files.txt","size":160,"category":"other"},{"path":"logs/vuln_variant/e1cd/attempt2_page_angle_php.txt","filename":"attempt2_page_angle_php.txt","size":283,"category":"other"},{"path":"logs/vuln_variant/e1cd/uploaded_php_files.txt","filename":"uploaded_php_files.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/e1cd/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"logs/vuln_variant/e1cd/login_response.txt","filename":"login_response.txt","size":767,"category":"other"},{"path":"logs/vuln_variant/manual_fb77_cookie_phtml.txt","filename":"manual_fb77_cookie_phtml.txt","size":1317,"category":"other"},{"path":"logs/vuln_variant/retry_token_prefix.txt","filename":"retry_token_prefix.txt","size":38,"category":"other"},{"path":"logs/vuln_variant/probe_e1cd_htaccess_chain.txt","filename":"probe_e1cd_htaccess_chain.txt","size":0,"category":"other"},{"path":"logs/vuln_variant/probe_ready.txt","filename":"probe_ready.txt","size":15,"category":"other"},{"path":"logs/vuln_variant/probe_page_upload_phtml_e1cd.txt","filename":"probe_page_upload_phtml_e1cd.txt","size":515,"category":"other"},{"path":"logs/vuln_variant/latest_token.txt","filename":"latest_token.txt","size":1,"category":"other"},{"path":"logs/vuln_variant/probe_latest_php82_stdout.txt","filename":"probe_latest_php82_stdout.txt","size":5,"category":"other"},{"path":"logs/vuln_variant/probe_token_delivery_modes_stdout.txt","filename":"probe_token_delivery_modes_stdout.txt","size":1201,"category":"other"},{"path":"logs/vuln_variant/latest_login.txt","filename":"latest_login.txt","size":459,"category":"other"},{"path":"logs/vuln_variant/latest_php82_build.log","filename":"latest_php82_build.log","size":28954,"category":"log"},{"path":"logs/vuln_variant/probe_upload_token_both.txt","filename":"probe_upload_token_both.txt","size":347,"category":"other"},{"path":"logs/vuln_variant_e1cd_install_probe.log","filename":"vuln_variant_e1cd_install_probe.log","size":20,"category":"log"},{"path":"coding/verify_logs/base/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"coding/verify_logs/base/health_http_code.txt","filename":"health_http_code.txt","size":4,"category":"other"},{"path":"coding/verify_logs/base/seed_item_output.txt","filename":"seed_item_output.txt","size":7,"category":"other"},{"path":"coding/verify_logs/base/uploaded_phtml_files.txt","filename":"uploaded_phtml_files.txt","size":60,"category":"other"},{"path":"coding/verify_logs/base/container.log","filename":"container.log","size":937,"category":"log"},{"path":"coding/verify_logs/base/phtml_count.txt","filename":"phtml_count.txt","size":2,"category":"other"},{"path":"coding/verify_logs/base/upload_response.txt","filename":"upload_response.txt","size":451,"category":"other"},{"path":"coding/verify_logs/base/all_uploaded_files.txt","filename":"all_uploaded_files.txt","size":100,"category":"other"},{"path":"coding/verify_logs/base/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"coding/verify_logs/base/login_response.txt","filename":"login_response.txt","size":767,"category":"other"},{"path":"coding/verify_logs/build_patched.log","filename":"build_patched.log","size":877,"category":"log"},{"path":"coding/verify_logs/patch_apply.log","filename":"patch_apply.log","size":79,"category":"log"},{"path":"coding/verify_logs/summary.txt","filename":"summary.txt","size":404,"category":"other"},{"path":"coding/verify_logs/build_base.log","filename":"build_base.log","size":874,"category":"log"},{"path":"coding/verify_logs/git_checkout_base.log","filename":"git_checkout_base.log","size":636,"category":"log"},{"path":"coding/verify_logs/git_checkout_patched.log","filename":"git_checkout_patched.log","size":636,"category":"log"},{"path":"coding/verify_logs/patched/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"coding/verify_logs/patched/health_http_code.txt","filename":"health_http_code.txt","size":4,"category":"other"},{"path":"coding/verify_logs/patched/seed_item_output.txt","filename":"seed_item_output.txt","size":7,"category":"other"},{"path":"coding/verify_logs/patched/uploaded_phtml_files.txt","filename":"uploaded_phtml_files.txt","size":0,"category":"other"},{"path":"coding/verify_logs/patched/container.log","filename":"container.log","size":937,"category":"log"},{"path":"coding/verify_logs/patched/phtml_count.txt","filename":"phtml_count.txt","size":2,"category":"other"},{"path":"coding/verify_logs/patched/upload_response.txt","filename":"upload_response.txt","size":501,"category":"other"},{"path":"coding/verify_logs/patched/all_uploaded_files.txt","filename":"all_uploaded_files.txt","size":40,"category":"other"},{"path":"coding/verify_logs/patched/install_output.txt","filename":"install_output.txt","size":20,"category":"other"},{"path":"coding/verify_logs/patched/login_response.txt","filename":"login_response.txt","size":767,"category":"other"},{"path":"coding/verify_logs/git_clone.log","filename":"git_clone.log","size":64,"category":"log"},{"path":"coding/verify_fix.sh","filename":"verify_fix.sh","size":6148,"category":"other"},{"path":"coding/summary_report.md","filename":"summary_report.md","size":2442,"category":"documentation"}]}