{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "d816cce81d3b8f1875b1d73c67be52208bcd3423510927e8dca43b2b15f19288",
    "authored_runtime_manifest_sha256": "82b3de5dea693b6d255e6d4f93cb0baf8b00ee933eb2555e54b4a23a8292a1b7",
    "authored_verdict_sha256": "318257bb4ae936e50c6102c7fb29490f64b25439d0d6ff687770e0fd2d9cd629",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "attacker_controlled_input": "calcext:data-mapping xlink:href in a crafted .fods document (csv provider): file:// local path for LFI, http:// attacker host for GET SSRF",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "ssrf",
  "claimed_surface": "viewer_document",
  "crash_observed": false,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "ssrf",
  "read_write_primitive_observed": false,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "LibreOffice Calc document load -> ScExternalDataMapper -> csv data provider fetch of persisted xlink:href without link-update gate",
  "validated_surface": "viewer_document"
}