[2026-07-01T14:41:31+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:41:31+00:00] Ensuring required Docker images are available ... [2026-07-01T14:41:31+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:41:31+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:41:31+00:00] Image postgres:15 already present [2026-07-01T14:41:31+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:41:31+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T14:41:32+00:00] Waiting for vuln dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:42:37+00:00] vuln dotCMS MainServlet init completed after 65s [2026-07-01T14:42:37+00:00] Waiting for vuln dotCMS HTTP port 8082 to respond ... [2026-07-01T14:43:38+00:00] vuln dotCMS HTTP port did not respond with 200 within 60s [2026-07-01T14:43:38+00:00] FAIL: vulnerable stack did not start [2026-07-01T14:44:19+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:44:19+00:00] Ensuring required Docker images are available ... [2026-07-01T14:44:19+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:44:19+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:44:19+00:00] Image postgres:15 already present [2026-07-01T14:44:19+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:44:19+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T14:44:21+00:00] Waiting for vuln dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:45:26+00:00] vuln dotCMS MainServlet init completed after 65s [2026-07-01T14:45:26+00:00] Waiting for vuln dotCMS HTTP port 8082 to respond ... [2026-07-01T14:47:26+00:00] vuln dotCMS HTTP port did not respond within 120s [2026-07-01T14:47:26+00:00] FAIL: vulnerable stack did not start [2026-07-01T14:49:02+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:49:02+00:00] Ensuring required Docker images are available ... [2026-07-01T14:49:02+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:49:02+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:49:03+00:00] Image postgres:15 already present [2026-07-01T14:49:03+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:49:03+00:00] Image python:3-slim already present [2026-07-01T14:49:03+00:00] Image curlimages/curl:latest already present [2026-07-01T14:49:03+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T14:49:04+00:00] Waiting for vuln dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:50:19+00:00] vuln dotCMS MainServlet init completed after 75s [2026-07-01T14:50:19+00:00] Waiting for vuln dotCMS HTTP service to respond ... [2026-07-01T14:50:21+00:00] vuln dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T14:50:21+00:00] Running SQLi tests against vuln dotCMS ... /usr/local/bin/python3: can't find '__main__' module in '/test_api.py' [2026-07-01T14:50:52+00:00] === vuln stack cleaned up === [2026-07-01T14:50:52+00:00] === Starting fixed stack (dotcms/dotcms:26.04.28-03) on port 8083 === [2026-07-01T14:50:53+00:00] Waiting for fixed dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:51:50+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:51:50+00:00] Ensuring required Docker images are available ... [2026-07-01T14:51:50+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:51:50+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:51:50+00:00] Image postgres:15 already present [2026-07-01T14:51:50+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:51:51+00:00] Image python:3-slim already present [2026-07-01T14:51:51+00:00] Image curlimages/curl:latest already present [2026-07-01T14:51:51+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T14:51:56+00:00] Waiting for vuln dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:53:47+00:00] vuln dotCMS MainServlet init completed after 110s [2026-07-01T14:53:47+00:00] Waiting for vuln dotCMS HTTP service to respond ... [2026-07-01T14:53:52+00:00] vuln dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T14:53:52+00:00] Running SQLi tests against vuln dotCMS ... /usr/local/bin/python3: can't find '__main__' module in '/out/test_api.py' [2026-07-01T14:54:25+00:00] === vuln stack cleaned up === [2026-07-01T14:54:25+00:00] === Starting fixed stack (dotcms/dotcms:26.04.28-03) on port 8083 === [2026-07-01T14:54:29+00:00] Waiting for fixed dotCMS to finish startup (timeout 240s) ... [2026-07-01T14:54:53+00:00] fixed dotCMS did not become ready within 240s [2026-07-01T14:54:53+00:00] FAIL: fixed stack did not start [2026-07-01T14:56:43+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:56:43+00:00] Ensuring required Docker images are available ... [2026-07-01T14:56:45+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:56:45+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:56:45+00:00] Image postgres:15 already present [2026-07-01T14:56:45+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:56:45+00:00] Image python:3-slim already present [2026-07-01T14:56:45+00:00] Image curlimages/curl:latest already present [2026-07-01T14:56:45+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T14:58:29+00:00] fixed dotCMS did not become ready within 240s [2026-07-01T14:58:29+00:00] FAIL: fixed stack did not start /data/pruva/runs/4dd81fac-256b-4e53-a2fb-e84a27da7017/bundle/repro/reproduction_steps.sh: line 227: cleanup_done: unbound variable [2026-07-01T14:58:52+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:58:52+00:00] Ensuring required Docker images are available ... [2026-07-01T14:58:53+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:58:53+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:58:53+00:00] Image postgres:15 already present [2026-07-01T14:58:53+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:58:53+00:00] Image python:3-slim already present [2026-07-01T14:58:53+00:00] Image curlimages/curl:latest already present [2026-07-01T14:58:53+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-os" is already in use by container "62c5f35d94c2e407d37e3abec680c52c2d93125a643d5ea21f7bf8474ed1e59f". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information [2026-07-01T14:59:22+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T14:59:22+00:00] Ensuring required Docker images are available ... [2026-07-01T14:59:22+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T14:59:22+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T14:59:22+00:00] Image postgres:15 already present [2026-07-01T14:59:22+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T14:59:22+00:00] Image python:3-slim already present [2026-07-01T14:59:22+00:00] Image curlimages/curl:latest already present [2026-07-01T14:59:22+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-os" is already in use by container "62c5f35d94c2e407d37e3abec680c52c2d93125a643d5ea21f7bf8474ed1e59f". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-pg" is already in use by container "3de696f16074f8fc8f9141c2d072d289eafdc16853fafaae640e764377d4f92d". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-pg" is already in use by container "3de696f16074f8fc8f9141c2d072d289eafdc16853fafaae640e764377d4f92d". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-dotcms" is already in use by container "5f688c9aeef9e97934282117fe057f3ab4d70fe1eabd0e376a200874969d4d0d". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information [2026-07-01T14:59:37+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... [2026-07-01T14:59:37+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... docker: Error response from daemon: Conflict. The container name "/pruva-cve20268054-vuln-dotcms" is already in use by container "5f688c9aeef9e97934282117fe057f3ab4d70fe1eabd0e376a200874969d4d0d". You have to remove (or rename) that container to be able to reuse that name. Run 'docker run --help' for more information [2026-07-01T14:59:37+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... [2026-07-01T15:00:30+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T15:00:30+00:00] Ensuring required Docker images are available ... [2026-07-01T15:00:30+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T15:00:30+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T15:00:30+00:00] Image postgres:15 already present [2026-07-01T15:00:30+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T15:00:30+00:00] Image python:3-slim already present [2026-07-01T15:00:30+00:00] Image curlimages/curl:latest already present [2026-07-01T15:00:30+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T15:00:32+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... [2026-07-01T15:03:04+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T15:03:04+00:00] Ensuring required Docker images are available ... [2026-07-01T15:03:04+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T15:03:04+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T15:03:05+00:00] Image postgres:15 already present [2026-07-01T15:03:05+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T15:03:05+00:00] Image python:3-slim already present [2026-07-01T15:03:05+00:00] Image curlimages/curl:latest already present [2026-07-01T15:03:05+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T15:03:06+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... [2026-07-01T15:04:11+00:00] vuln dotCMS is live and ready after 65s [2026-07-01T15:04:11+00:00] Waiting for vuln dotCMS HTTP service to respond ... [2026-07-01T15:04:13+00:00] vuln dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T15:04:13+00:00] Running SQLi tests against vuln dotCMS ... [2026-07-01T15:04:22+00:00] vuln dotCMS MainServlet init completed after 285s [2026-07-01T15:04:22+00:00] Waiting for vuln dotCMS HTTP service to respond ... [2026-07-01T15:04:39+00:00] vuln dotCMS did not become ready within 300s [2026-07-01T15:04:39+00:00] vuln dotCMS did not become ready within 300s [2026-07-01T15:04:39+00:00] FAIL: vulnerable stack did not start [2026-07-01T15:04:39+00:00] FAIL: vulnerable stack did not start /data/pruva/runs/4dd81fac-256b-4e53-a2fb-e84a27da7017/bundle/repro/reproduction_steps.sh: line 220: cleanup_done: unbound variable /data/pruva/runs/4dd81fac-256b-4e53-a2fb-e84a27da7017/bundle/repro/reproduction_steps.sh: line 220: cleanup_done: unbound variable [2026-07-01T15:04:50+00:00] === vuln stack cleaned up === [2026-07-01T15:04:50+00:00] === Starting fixed stack (dotcms/dotcms:26.04.28-03) on port 8083 === [2026-07-01T15:04:51+00:00] Waiting for fixed dotCMS to finish startup (timeout 300s) ... docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information [2026-07-01T15:05:34+00:00] vuln dotCMS did not become ready within 300s [2026-07-01T15:05:34+00:00] FAIL: vulnerable stack did not start /data/pruva/runs/4dd81fac-256b-4e53-a2fb-e84a27da7017/bundle/repro/reproduction_steps.sh: line 220: cleanup_done: unbound variable docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information [2026-07-01T15:06:02+00:00] fixed dotCMS is live and ready after 70s [2026-07-01T15:06:02+00:00] Waiting for fixed dotCMS HTTP service to respond ... [2026-07-01T15:06:03+00:00] fixed dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T15:06:03+00:00] Running SQLi tests against fixed dotCMS ... docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information [2026-07-01T15:06:32+00:00] === fixed stack cleaned up === VULN_TRUE_DURATION=5.023 VULN_FALSE_DURATION=0.061 FIXED_TRUE_DURATION=0.007 CONFIRMED=True [2026-07-01T15:06:32+00:00] REPRODUCTION CONFIRMED docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information docker: Error response from daemon: failed to set up container networking: network pruva-cve20268054-vuln-net not found Run 'docker run --help' for more information [2026-07-01T15:06:47+00:00] vuln dotCMS HTTP service did not respond within 120s [2026-07-01T15:06:47+00:00] FAIL: vulnerable stack did not start /data/pruva/runs/4dd81fac-256b-4e53-a2fb-e84a27da7017/bundle/repro/reproduction_steps.sh: line 226: cleanup_done: unbound variable [2026-07-01T15:06:49+00:00] PROJECT_CACHE_DIR=/data/pruva/project-cache/cd59550f-2d00-49b2-a7d3-882c3d761e8c [2026-07-01T15:06:49+00:00] Ensuring required Docker images are available ... [2026-07-01T15:06:49+00:00] Image dotcms/dotcms:26.04.28-02 already present [2026-07-01T15:06:49+00:00] Image dotcms/dotcms:26.04.28-03 already present [2026-07-01T15:06:50+00:00] Image postgres:15 already present [2026-07-01T15:06:50+00:00] Image opensearchproject/opensearch:1.3.19 already present [2026-07-01T15:06:50+00:00] Image python:3-slim already present [2026-07-01T15:06:50+00:00] Image curlimages/curl:latest already present [2026-07-01T15:06:50+00:00] === Starting vuln stack (dotcms/dotcms:26.04.28-02) on port 8082 === [2026-07-01T15:06:51+00:00] Waiting for vuln dotCMS to finish startup (timeout 300s) ... [2026-07-01T15:08:06+00:00] vuln dotCMS is live and ready after 75s [2026-07-01T15:08:06+00:00] Waiting for vuln dotCMS HTTP service to respond ... [2026-07-01T15:08:08+00:00] vuln dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T15:08:08+00:00] Running SQLi tests against vuln dotCMS ... [2026-07-01T15:08:45+00:00] === vuln stack cleaned up === [2026-07-01T15:08:45+00:00] === Starting fixed stack (dotcms/dotcms:26.04.28-03) on port 8083 === [2026-07-01T15:08:46+00:00] Waiting for fixed dotCMS to finish startup (timeout 300s) ... [2026-07-01T15:09:51+00:00] fixed dotCMS is live and ready after 65s [2026-07-01T15:09:51+00:00] Waiting for fixed dotCMS HTTP service to respond ... [2026-07-01T15:09:53+00:00] fixed dotCMS healthcheck returned HTTP 404 after 0s [2026-07-01T15:09:53+00:00] Running SQLi tests against fixed dotCMS ... [2026-07-01T15:10:24+00:00] === fixed stack cleaned up === VULN_TRUE_DURATION=5.015 VULN_FALSE_DURATION=0.063 FIXED_TRUE_DURATION=0.008 CONFIRMED=True [2026-07-01T15:10:25+00:00] REPRODUCTION CONFIRMED