{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /upload multipart to CodeIgniter4 controller using is_image rule, saving with client filename into public/uploads; GET /uploads/shell.php?cmd=...",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "php-cli",
    "codeigniter4/framework (php spark serve, PHP built-in web server)"
  ],
  "proof_artifacts": [
    "logs/repro/control_upload.json",
    "logs/repro/service_vuln_1.log",
    "logs/repro/vuln_attempt1_upload.json",
    "logs/repro/vuln_attempt1_shell_get.txt",
    "logs/repro/service_vuln_2.log",
    "logs/repro/vuln_attempt2_upload.json",
    "logs/repro/vuln_attempt2_shell_get.txt",
    "logs/repro/service_fixed_1.log",
    "logs/repro/fixed_attempt1_upload.json",
    "logs/repro/fixed_attempt1_shell_get.txt",
    "logs/repro/service_fixed_2.log",
    "logs/repro/fixed_attempt2_upload.json",
    "logs/repro/fixed_attempt2_shell_get.txt"
  ],
  "notes": "CONFIRMED: v4.7.3 accepted GIF89a+PHP polyglot as shell.php via is_image and GET /uploads/shell.php?cmd= executed attacker commands (uid output + unique marker) in 2/2 attempts; v4.7.4 rejected the same upload with a validation error, wrote no file, and GET returned 404 in 2/2 attempts. Named fixed commit b6e9a4fa unresolvable in framework mirror; fixed ref used: v4.7.4 (67ead895b7491703e5e5bc17436778806192008f)."
}