{
  "schema_version": 1,
  "equivalent": true,
  "confidence": 0.9,
  "parent_claim": "Untrusted /media/<path> route input selects a file opened by base.views.protected_media without enforcing the intended file security boundary.",
  "variant_claim": "The same route and open sink compare a raw path against a public-prefix boundary but open a normalized target outside that public subtree, allowing unauthenticated private-media read.",
  "shared_entrypoint": "GET /media/<path>",
  "shared_route": "base/urls.py re_path ^media/(?P<path>.*)$",
  "shared_function": "base.views.protected_media",
  "shared_sink": "FileResponse(open(media_path, rb))",
  "shared_attacker_control": "HTTP route path",
  "shared_trust_boundary": "remote HTTP caller to Horilla server filesystem read",
  "shared_impact_class": "information disclosure",
  "difference": "The parent violates MEDIA_ROOT containment and composes Referer authorization; the variant remains inside MEDIA_ROOT but violates the narrower public-media subtree authorization boundary through raw-versus-normalized path mismatch and requires no Referer.",
  "not_equated": [
    "The variant does not prove outside-MEDIA_ROOT read on fixed/current targets.",
    "The variant is not a separate unrelated file endpoint or local self-attack."
  ],
  "evidence": [
    "logs/vuln_variant/matrix_summary.json",
    "logs/vuln_variant/runtime_fixed/result.json",
    "logs/vuln_variant/runtime_latest_v1/result.json",
    "logs/vuln_variant/runtime_latest_v2/result.json",
    "vuln_variant/patch_analysis.md"
  ]
}