{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "HTTP GET /download?name=<traversal> on xmysql (lib/xapi.js downloadFile)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "mariadb",
    "xmysql-0.6.0-node-express"
  ],
  "target_identity": {
    "repository_url": "https://github.com/o1lab/xmysql",
    "commit_sha": "8c6b00ee22860230975e43ab705d015d2235e308",
    "target_digest": "d7544f1501df408c3c5353b430cef5842b463250b64824974436575afb948112",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/xmysql_service.log",
    "logs/health_response.json",
    "logs/download_passwd_headers.txt",
    "logs/downloaded_passwd.txt",
    "logs/download_secret_headers.txt",
    "logs/downloaded_secret.txt",
    "logs/download_benign_status.txt"
  ],
  "notes": "Unauthenticated arbitrary file read confirmed: /etc/passwd byte-identical and planted secret token recovered via ../ traversal in the name query parameter. No patched upstream version exists (project archived, renamed to NocoDB)."
}