=== CVE-2026-58166 variant/bypass check: Sun Jul 5 15:11:07 UTC 2026 === SOURCE_REPO=/data/pruva/project-cache/cb19670c-9322-4afb-8baf-ad6441138574/repo VULNERABLE_COMMIT=a6a5cda5560053136897aa44301eacc6c48d8168 FIXED_COMMIT=4fd4da603801766b14ad8788649cfc1ad21f99a6 LATEST_ORIGIN_MAIN=4fd4da603801766b14ad8788649cfc1ad21f99a6 PYTHON_BIN=/data/pruva/project-cache/cb19670c-9322-4afb-8baf-ad6441138574/venv/bin/python ----- Running candidate driver for vulnerable at a6a5cda5560053136897aa44301eacc6c48d8168 ----- { "role": "vulnerable", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_vulnerable", "cases": [ { "case": "baseline_parent_traversal_symlink", "role": "vulnerable", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_vulnerable", "filename_supplied": "../../../../../../../../../../../../../../../../../../../../data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_baseline_parent_traversal_symlink_link.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_baseline_parent_traversal_symlink_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_baseline_parent_traversal_symlink_link.txt", "target_exists_before": false, "link_is_symlink_before": true, "preexisting_target": false, "use_symlink": true, "exception": null, "record_name": "../../../../../../../../../../../../../../../../../../../../data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_baseline_parent_traversal_symlink_link.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_vulnerable_baseline_parent_traversal_symlink/session_variant_session/code_workspace/attachments/2af5eaa31fcf45a48e600e1a903c07b0/vulnerable_baseline_parent_traversal_symlink_link.txt", "record_size": 57, "target_exists_after": true, "link_exists_after": false, "link_is_symlink_after": false, "target_content_after": "PAYLOAD_FROM_vulnerable_baseline_parent_traversal_symlink", "target_contains_payload": true, "target_preserved_original": false, "escaped_temp_dir_via_write": true, "deleted_supplied_path": true }, { "case": "candidate_absolute_filename_symlink", "role": "vulnerable", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_vulnerable", "filename_supplied": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_symlink_link.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_symlink_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_symlink_link.txt", "target_exists_before": false, "link_is_symlink_before": true, "preexisting_target": false, "use_symlink": true, "exception": null, "record_name": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_symlink_link.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_vulnerable_candidate_absolute_filename_symlink/session_variant_session/code_workspace/attachments/c30f08f3f5ff42b39ce49b938d1a2575/vulnerable_candidate_absolute_filename_symlink_link.txt", "record_size": 59, "target_exists_after": true, "link_exists_after": false, "link_is_symlink_after": false, "target_content_after": "PAYLOAD_FROM_vulnerable_candidate_absolute_filename_symlink", "target_contains_payload": true, "target_preserved_original": false, "escaped_temp_dir_via_write": true, "deleted_supplied_path": true }, { "case": "candidate_absolute_filename_delete", "role": "vulnerable", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_vulnerable", "filename_supplied": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_delete_target.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_delete_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_delete_link.txt", "target_exists_before": true, "link_is_symlink_before": false, "preexisting_target": true, "use_symlink": false, "exception": null, "record_name": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_delete_target.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_vulnerable_candidate_absolute_filename_delete/session_variant_session/code_workspace/attachments/7148aaf169814b32885aaa820962522b/vulnerable_candidate_absolute_filename_delete_target.txt", "record_size": 58, "target_exists_after": false, "link_exists_after": false, "link_is_symlink_after": false, "target_content_after": null, "target_contains_payload": false, "target_preserved_original": false, "escaped_temp_dir_via_write": false, "deleted_supplied_path": true } ] } ----- Running candidate driver for fixed at 4fd4da603801766b14ad8788649cfc1ad21f99a6 ----- { "role": "fixed", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_fixed", "cases": [ { "case": "baseline_parent_traversal_symlink", "role": "fixed", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_fixed", "filename_supplied": "../../../../../../../../../../../../../../../../../../../../data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_baseline_parent_traversal_symlink_link.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_baseline_parent_traversal_symlink_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_baseline_parent_traversal_symlink_link.txt", "target_exists_before": false, "link_is_symlink_before": true, "preexisting_target": false, "use_symlink": true, "exception": null, "record_name": "fixed_baseline_parent_traversal_symlink_link.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_fixed_baseline_parent_traversal_symlink/session_variant_session/code_workspace/attachments/8e19e697a39143d18251cf3b6e14f7da/fixed_baseline_parent_traversal_symlink_link.txt", "record_size": 52, "target_exists_after": false, "link_exists_after": false, "link_is_symlink_after": true, "target_content_after": null, "target_contains_payload": false, "target_preserved_original": false, "escaped_temp_dir_via_write": false, "deleted_supplied_path": false }, { "case": "candidate_absolute_filename_symlink", "role": "fixed", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_fixed", "filename_supplied": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_symlink_link.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_symlink_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_symlink_link.txt", "target_exists_before": false, "link_is_symlink_before": true, "preexisting_target": false, "use_symlink": true, "exception": null, "record_name": "fixed_candidate_absolute_filename_symlink_link.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_fixed_candidate_absolute_filename_symlink/session_variant_session/code_workspace/attachments/9cbed01906e04b12a8538bdac291dead/fixed_candidate_absolute_filename_symlink_link.txt", "record_size": 54, "target_exists_after": false, "link_exists_after": false, "link_is_symlink_after": true, "target_content_after": null, "target_contains_payload": false, "target_preserved_original": false, "escaped_temp_dir_via_write": false, "deleted_supplied_path": false }, { "case": "candidate_absolute_filename_delete", "role": "fixed", "repo": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/src_fixed", "filename_supplied": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_delete_target.txt", "target": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_delete_target.txt", "link": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/fixed_candidate_absolute_filename_delete_link.txt", "target_exists_before": true, "link_is_symlink_before": false, "preexisting_target": true, "use_symlink": false, "exception": null, "record_name": "fixed_candidate_absolute_filename_delete_target.txt", "record_local_path": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/warehouse_fixed_candidate_absolute_filename_delete/session_variant_session/code_workspace/attachments/999f09f469574e0a8cae29b38efe8348/fixed_candidate_absolute_filename_delete_target.txt", "record_size": 53, "target_exists_after": true, "link_exists_after": false, "link_is_symlink_after": false, "target_content_after": "ORIGINAL_DO_NOT_TOUCH", "target_contains_payload": false, "target_preserved_original": true, "escaped_temp_dir_via_write": false, "deleted_supplied_path": false } ] } ===== VARIANT EVALUATION SUMMARY ===== { "created_at": "2026-07-05T15:11:08.457199+00:00", "vulnerable_commit": "a6a5cda5560053136897aa44301eacc6c48d8168", "fixed_commit": "4fd4da603801766b14ad8788649cfc1ad21f99a6", "latest_commit": "4fd4da603801766b14ad8788649cfc1ad21f99a6", "cases": { "baseline_parent_traversal_symlink": { "vulnerable_escaped_or_deleted": true, "fixed_escaped_or_deleted": false, "latest_escaped_or_deleted": false, "vulnerable_record_name": "../../../../../../../../../../../../../../../../../../../../data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_baseline_parent_traversal_symlink_link.txt", "fixed_record_name": "fixed_baseline_parent_traversal_symlink_link.txt", "latest_record_name": "fixed_baseline_parent_traversal_symlink_link.txt", "fixed_target_preserved_original": false, "latest_target_preserved_original": false }, "candidate_absolute_filename_symlink": { "vulnerable_escaped_or_deleted": true, "fixed_escaped_or_deleted": false, "latest_escaped_or_deleted": false, "vulnerable_record_name": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_symlink_link.txt", "fixed_record_name": "fixed_candidate_absolute_filename_symlink_link.txt", "latest_record_name": "fixed_candidate_absolute_filename_symlink_link.txt", "fixed_target_preserved_original": false, "latest_target_preserved_original": false }, "candidate_absolute_filename_delete": { "vulnerable_escaped_or_deleted": true, "fixed_escaped_or_deleted": false, "latest_escaped_or_deleted": false, "vulnerable_record_name": "/data/pruva/runs/3283e9ad-873d-4160-b2a4-c262fdf0e854/bundle/vuln_variant/test-files/vulnerable_candidate_absolute_filename_delete_target.txt", "fixed_record_name": "fixed_candidate_absolute_filename_delete_target.txt", "latest_record_name": "fixed_candidate_absolute_filename_delete_target.txt", "fixed_target_preserved_original": true, "latest_target_preserved_original": true } }, "bypass_confirmed": false, "vulnerable_only_alternate_trigger_observed": true, "fixed_blocks_parent_baseline": true, "exit_code": 1 }