{"entrypoint_kind": "api_remote", "entrypoint_detail": "Pagekit CMS 1.0.18 HTTP API \u2014 authenticated user privilege escalation via POST /api/user/{id} then package upload/install for RCE", "service_started": true, "healthcheck_passed": true, "target_path_reached": true, "runtime_stack": ["docker", "php:7.4-apache", "pagekit-cms-1.0.18", "sqlite"], "proof_artifacts": ["logs/reproduction_steps.log", "logs/exploit_evidence.txt", "logs/rce_id_output.txt", "logs/rce_whoami_output.txt"], "notes": "Editor (id=2) escalated privileges by self-assigning Package Manager role (id=4) via saveAction which only blocks Administrator role (id=3). RCE confirmed via webshell: id=uid=33(www-data) gid=33(www-data) groups=33(www-data) whoami=www-data"}