{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /api/v1/repos/{owner}/{repo}/diffpatch (services/repository/files/patch.go ApplyDiffPatch)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "gitea-1.27.0-binary",
    "sqlite3",
    "git"
  ],
  "proof_artifacts": [
    "logs/repro/gitea_vuln_stdout.log",
    "logs/repro/gitea_fixed_stdout.log",
    "logs/repro/vuln_call1_response.json",
    "logs/repro/vuln_call2_response.json",
    "logs/repro/fixed_call1_response.json",
    "logs/repro/fixed_call2_response.json",
    "logs/repro/vuln_diffpatch_calls.txt",
    "logs/repro/fixed_diffpatch_calls.txt",
    "logs/repro/vuln_registration.txt",
    "logs/repro/vuln_patch.txt",
    "logs/repro/vuln_rce_marker.txt"
  ],
  "notes": "RCE confirmed on vulnerable v1.27.0: unauthenticated registration -> repo create -> two /diffpatch calls plant and trigger hooks/post-index-change; hook executed as the Gitea OS user and wrote the RCE marker. Fixed v1.27.1 negative control: no marker. confirmed=yes vuln_marker=yes fixed_marker=no call1_vuln=201 call2_vuln=201 call1_fixed=201 call2_fixed=500 reg=303 auth=200"
}