{
  "claim_outcome": "not_confirmed",
  "claim_block_reason": "fix_complete",
  "repro_result": "not_reproduced",
  "validated_surface": "api_remote",
  "evidence_scope": "production_path",
  "claimed_impact_class": "code_execution",
  "observed_impact_class": "none",
  "exploitability_confidence": "low",
  "attacker_controlled_input": "multipart ZIP archive (custom_icon) containing .htaccess + uppercase .PHP web shell",
  "trigger_path": "index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon",
  "end_to_end_target_reached": false,
  "sanitizer_used": false,
  "crash_observed": false,
  "read_write_primitive_observed": false,
  "exploit_chain_demonstrated": false,
  "blocking_mitigation": "SP Page Builder 6.6.2 adds SppagebuilderControllerAsset::__construct() requiring core.admin/core.manage authorization, a logged-in user, and Session::checkToken(); also removes non-upload methods from the site controller and makes unpack() private.",
  "inferred": false
}