{
  "schema_version": 1,
  "equivalence_summary": "The parent and variant both reach base.views.protected_media on the real /media/<path> HTTP route and end at FileResponse(open(media_path, 'rb')) for a nonpublic file under MEDIA_ROOT without an authenticated user or valid JWT. The parent bypass abuses Referer-derived public-page authorization in 1.5.0. The variant bypass abuses raw public-media prefix classification in the 1.6.0 fix after safe_join normalizes dot-segments to a private in-root file.",
  "same_sink": true,
  "same_sink_detail": "base/views.py protected_media() returns FileResponse(open(media_path, 'rb')) for attacker-selected existing media_path.",
  "same_trust_boundary": true,
  "trust_boundary_detail": "Unauthenticated remote HTTP client controls request metadata/path to the real Horilla /media/<path> endpoint and receives the file response.",
  "same_security_property": true,
  "security_property": "Nonpublic media paths under MEDIA_ROOT must require an authenticated user/session or valid JWT.",
  "parent_trigger": {
    "target": "Horilla 1.5.0",
    "input": "Direct private /media/private-data/... path plus Referer: http://attacker.invalid/login",
    "flawed_assumption": "Client-controlled Referer path can prove the request originated from a public page."
  },
  "variant_trigger": {
    "target": "Horilla 1.6.0",
    "input": "Raw /media/base/icon/../../private-data/... path with no Referer",
    "flawed_assumption": "Raw path.startswith(public_prefix) proves the normalized file is inside a public media directory."
  },
  "not_the_same_trigger": true,
  "distinguishing_features": [
    "Variant requires no Referer header; the original fixed 1.6.0 Referer case is denied.",
    "Variant uses path normalization/public-prefix confusion rather than public-page Referer confusion.",
    "Variant reproduces on the fixed 1.6.0 release where the parent Referer trigger no longer works."
  ],
  "confidence": "high",
  "evidence": [
    "bundle/logs/vuln_variant/latest_matrix_summary.json",
    "bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/attempt_result.json",
    "bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_request.txt",
    "bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_response_body.bin",
    "bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/private_canary.txt"
  ]
}