{
  "alternate_trigger": true,
  "bypass": true,
  "confirmed": true,
  "end_to_end_target_reached": true,
  "evidence": [
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/matrix_summary.json",
    "logs/vuln_variant/runtime_fixed/result.json",
    "logs/vuln_variant/runtime_latest_v1/result.json",
    "logs/vuln_variant/runtime_latest_v2/result.json",
    "logs/vuln_variant/runtime_latest_v2/runtime_binding.json",
    "logs/vuln_variant/source_identity.log"
  ],
  "evidence_scope": "production_path_with_runtime_accommodations",
  "idempotency_runs_passed": 2,
  "impact": "unauthenticated read of a known process-readable private file inside MEDIA_ROOT",
  "impact_parity": "partial",
  "latest_v1_result": {
    "commit_sha": "11c4e3a2596c58f2381bda4c6bbc319a4430b097",
    "plain_outside_root_status": 404,
    "public_prefix_private_canary_returned": true,
    "public_prefix_private_read_status": 200
  },
  "limitations": [
    "The confirmed C3 bypass remains inside MEDIA_ROOT and is not an arbitrary host filesystem traversal.",
    "The Docker daemon became unavailable; fresh final evidence used exact hash-bound Horilla URL/view files under Django WSGI in a target process and raw TCP HTTP from a separate attacker process.",
    "Optional ABI-bound imports were stubbed; affected route/view source was unmodified and hash-bound. Current-v2 used a narrow Django 5.2 compatibility namespace because the available cache contained Django 4.2.24."
  ],
  "same_root_cause": true,
  "same_sink": "base.views.protected_media FileResponse(open(media_path, rb))",
  "same_trust_boundary": "unauthenticated remote HTTP caller controls the /media/<path> route argument",
  "schema_version": 1,
  "script_exit_code": 0,
  "stage": "vuln_variant",
  "submitted_target_result": {
    "commit_sha": "61bd5173220d19925ad8220db9152a75c881ea73",
    "plain_outside_root_status": 200,
    "public_prefix_private_canary_returned": true,
    "public_prefix_private_read_status": 200
  },
  "summary": "The patched/current endpoint authorizes the raw path by public prefix but opens its safe_join-normalized target. /media/base/icon/../../private_<canary>.txt returns the exact private MEDIA_ROOT canary without credentials on fixed 1.6.0 and current 1.x/v2.",
  "variant_id": "GHSA-x52c-5hrq-76pq-public-prefix-normalization",
  "variant_target_result": {
    "commit_sha": "b3bd29d15819cbece45c58e6268ddd0614e387d6",
    "plain_outside_root_status": 404,
    "public_prefix_private_canary_returned": true,
    "public_prefix_private_read_status": 200,
    "ref": "refs/tags/1.6.0",
    "version": "1.6.0"
  },
  "verdict": "confirmed_distinct_bypass"
}