{
  "entrypoint_detail": "real Horilla /media/<path> HTTP route",
  "entrypoint_kind": "endpoint",
  "healthcheck_passed": true,
  "latest_inspected_commit": "11c4e3a2596c58f2381bda4c6bbc319a4430b097",
  "latest_inspected_ref": "origin/master",
  "notes": "Confirmed bypass: Horilla 1.6.0 returns an unauthenticated private canary when the raw /media/ path starts with public prefix base/icon/ and then uses ../../ to resolve to the private file inside MEDIA_ROOT.",
  "proof_artifacts": [
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/attempt_result.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/attempt_setup.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/container_id.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/container_inspect.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/health_response_body.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/health_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/media/base/icon/liveness-20260722T061846Z-17685-fixed.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/media/private-data/20260722T061846Z-17685/fixed-secret.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/modified_file_inventory_after_startup.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/private_canary.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_canary.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/runtime/TestDB_Horilla.sqlite3",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/server_final.log",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/server_startup.log",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/attempt_result.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/attempt_setup.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/container_id.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/container_inspect.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/health_response_body.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/health_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/media/base/icon/liveness-20260722T061846Z-17685-vuln.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/media/private-data/20260722T061846Z-17685/vuln-secret.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/modified_file_inventory_after_startup.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/private_canary.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_canary.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_curl_stderr.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_curl_trace.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_meta.json",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_request.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_response_body.bin",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_response_headers.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/runtime/TestDB_Horilla.sqlite3",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/server_final.log",
    "vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/server_startup.log",
    "vuln_variant/runtime_20260722T061846Z-17685/cache_context_resolved.json",
    "vuln_variant/runtime_20260722T061846Z-17685/deps/fixed_7fb44184827cf327_pip_freeze.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/deps/vuln_f86e9625862fa828_pip_freeze.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/matrix_summary.json",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/fixed/modified_file_inventory_after_prepare.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/fixed/prepare_runtime.log",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/fixed/runtime/TestDB_Horilla.sqlite3",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/vuln/modified_file_inventory_after_prepare.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/vuln/prepare_runtime.log",
    "vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/vuln/runtime/TestDB_Horilla.sqlite3",
    "vuln_variant/runtime_20260722T061846Z-17685/source/fixed_tested_commit.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/source/fixed_worktree_head.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/source/patch_and_security_scope.log",
    "vuln_variant/runtime_20260722T061846Z-17685/source/vuln_tested_commit.txt",
    "vuln_variant/runtime_20260722T061846Z-17685/source/vuln_worktree_head.txt",
    "logs/vuln_variant/reproduction_steps_20260722T061846Z-17685.log"
  ],
  "runtime_stack": [
    "Docker",
    "python:3.10-slim-bullseye",
    "Horilla Django runserver",
    "SQLite"
  ],
  "service_started": true,
  "source_fix_commit": "b6eaec1386d8b8741a42fe7c78f318f073375791",
  "target_path_reached": true,
  "tested_fixed_commit": "b3bd29d15819cbece45c58e6268ddd0614e387d6",
  "tested_vulnerable_commit": "61bd5173220d19925ad8220db9152a75c881ea73",
  "variant_confirmed_on_fixed": true
}