Verified reproduction
GHSA-x52c-5hrq-76pq: Horilla HRMS protected_media path traversal enables outside-root file read
GHSA-x52c-5hrq-76pq is verified against horilla/horilla-hr · github affected versions: >=1.3.1, <1.6.0 fixed version: 1.6.0 vulnerability class: Path Traversal This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00295.
Severity HIGH
Confidence HIGH
Reproduced in 87m 3s
Tool calls 743
Spend $75.87
Affected >=1.3.1, <1.6.0
Fixed in 1.6.0
$
pruva-verify REPRO-2026-00295 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00295/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
Pruva Ticket Brief: Horilla Protected-Media Path Traversal
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/repro/reproduction_steps.sh29.6 KBbundle/repro/rca_report.md9.6 KBbundle/repro/runtime_manifest.json3.7 KBbundle/logs/clean_execution_1.log1.2 KBbundle/logs/clean_execution_2.log1.2 KBbundle/logs/reproduction_steps.log1.2 KBbundle/logs/http-proof/matrix_summary.json4.5 KBbundle/logs/http-proof/source_identity.log0.3 KBbundle/logs/http-proof/modified_files.log0.5 KBbundle/logs/http-proof/run_1_vulnerable/result.json1.3 KBbundle/logs/http-proof/run_2_vulnerable/result.json1.3 KBbundle/logs/http-proof/run_1_fixed/result.json1.3 KBbundle/logs/http-proof/run_2_fixed/result.json1.3 KBbundle/logs/http-proof/run_1_vulnerable/server.log1.0 KBbundle/logs/http-proof/run_2_vulnerable/server.log1.0 KBbundle/logs/http-proof/run_1_fixed/server.log1.2 KBbundle/logs/http-proof/run_2_fixed/server.log1.2 KBbundle/logs/http-proof/run_1_vulnerable/request_unauthenticated_escape.json0.3 KBbundle/logs/http-proof/run_1_vulnerable/response_unauthenticated_escape.json0.9 KBbundle/logs/http-proof/run_2_vulnerable/request_unauthenticated_escape.json0.3 KBbundle/logs/http-proof/run_2_vulnerable/response_unauthenticated_escape.json0.9 KBbundle/logs/http-proof/run_1_fixed/request_unauthenticated_escape.json0.3 KBbundle/logs/http-proof/run_1_fixed/response_unauthenticated_escape.json0.8 KBbundle/logs/http-proof/run_2_fixed/request_unauthenticated_escape.json0.3 KBbundle/logs/http-proof/run_2_fixed/response_unauthenticated_escape.json0.8 KBbundle/logs/http-proof/run_1_vulnerable/runtime_binding.log0.7 KBbundle/logs/http-proof/run_2_vulnerable/runtime_binding.log0.7 KBbundle/logs/http-proof/run_1_fixed/runtime_binding.log0.7 KBbundle/logs/http-proof/run_2_fixed/runtime_binding.log0.7 KBbundle/logs/http-proof/run_1_vulnerable/provision_identity.log0.5 KBbundle/logs/http-proof/run_2_vulnerable/provision_identity.log0.5 KBbundle/logs/http-proof/run_1_fixed/provision_identity.log0.5 KBbundle/logs/http-proof/run_2_fixed/provision_identity.log0.5 KBbundle/logs/http-proof/run_1_vulnerable/generated_migrations_inventory.log2.4 KBbundle/logs/http-proof/run_2_vulnerable/generated_migrations_inventory.log2.4 KBbundle/logs/http-proof/run_1_fixed/generated_migrations_inventory.log2.4 KBbundle/logs/http-proof/run_2_fixed/generated_migrations_inventory.log2.4 KBbundle/logs/http-proof/run_1_vulnerable/target_container_identity.log0.2 KBbundle/logs/http-proof/run_1_vulnerable/attacker_container_identity.log0.2 KBbundle/logs/http-proof/run_1_fixed/target_container_identity.log0.2 KBbundle/logs/http-proof/run_1_fixed/attacker_container_identity.log0.2 KBbundle/logs/http-proof/run_2_vulnerable/target_container_identity.log0.2 KBbundle/logs/http-proof/run_2_vulnerable/attacker_container_identity.log0.2 KBbundle/logs/http-proof/run_2_fixed/target_container_identity.log0.2 KBbundle/logs/http-proof/run_2_fixed/attacker_container_identity.log0.2 KBbundle/logs/http-proof/run_1_vulnerable/request_authenticated_escape.json0.4 KBbundle/logs/http-proof/run_1_vulnerable/response_authenticated_escape.json0.9 KBbundle/logs/http-proof/run_1_fixed/request_authenticated_escape.json0.4 KBbundle/logs/http-proof/run_1_fixed/response_authenticated_escape.json0.8 KBbundle/logs/http-proof/run_2_vulnerable/request_authenticated_escape.json0.4 KBbundle/logs/http-proof/run_2_vulnerable/response_authenticated_escape.json0.9 KBbundle/logs/http-proof/run_2_fixed/request_authenticated_escape.json0.4 KBbundle/logs/http-proof/run_2_fixed/response_authenticated_escape.json0.8 KBbundle/repro/validation_verdict.json0.8 KB