{
  "entrypoint_kind": "api_remote",
  "entrypoint_detail": "Coolify authenticated POST /livewire/update driving server.destinations add($name) (network supplied as a Livewire method argument, not a validated property)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "variant_confirmed_on_vulnerable": true,
  "bypass_on_fixed": false,
  "vulnerable_markers": [
    "/tmp/coolify_variant_pwned_vuln_1",
    "/tmp/coolify_variant_pwned_vuln_2"
  ],
  "fixed_markers": [],
  "runtime_stack": [
    "coolify (Laravel app, official image)",
    "postgres:15",
    "redis:7",
    "coolify-realtime (soketi)",
    "coolify-testing-host (SSH target, root)"
  ],
  "proof_artifacts": [
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/stack_vulnerable.log",
    "logs/vuln_variant/setup_vulnerable.log",
    "logs/vuln_variant/vulnerable_attempt_1.log",
    "logs/vuln_variant/vulnerable_attempt_2.log",
    "logs/vuln_variant/vulnerable_marker_1.txt",
    "logs/vuln_variant/vulnerable_marker_2.txt",
    "logs/vuln_variant/stack_fixed.log",
    "logs/vuln_variant/setup_fixed.log",
    "logs/vuln_variant/fixed_attempt_1.log",
    "logs/vuln_variant/fixed_attempt_2.log"
  ],
  "notes": "Variant entry point = App\\Livewire\\Server\\Destinations::add($name) (component server.destinations), untouched by PR #9228. Vulnerable beta.470: add('x;id > /tmp/marker #') -> StandaloneDocker::create -> created event -> instant_remote_process -> root cmd exec (marker=uid=0(root)). Fixed beta.471: StandaloneDocker::setNetworkAttribute mutator throws InvalidArgumentException -> no exec. Alternate trigger, not a bypass."
}