CP8 Independent Validation Receipt

Template: CVE-2026-112244 — Duplicator < 5.1.0, unauthenticated full path disclosure via installer entry points
Source PR: projectdiscovery/nuclei-templates#17682 by maulanawirawan
PR head commit: 1ef8c5669330db993282fc905650033071e68165
Template file SHA-256: 74e76b84a8f82624e316e8ca43f59a4fa6f1a694eb07bf0cdcfc4900825d4dda
Engine: nuclei v3.4.10 (official release binary)
Date: 2026-11-05 (America/Chicago)
Validator: ASINHHC-CP8 (@asinhhc / dbottrader) — third-party, independent of the template author

Method (mechanical only)

Two independent verifier runs (A and B), each a fresh nuclei process in a clean state, executed the template exactly as submitted against two local fixtures reproducing the responses the template itself specifies:

Vulnerable fixture (Duplicator < 5.1.0 behavior): HTTP 200 at /wp-content/plugins/duplicator/installer/dup-installer/main.installer.php with a body containing the uncaught-exception text Fatal error + Not init CSFR CLASS and a stack trace disclosing an absolute path.
Patched fixture (Duplicator ≥ 5.1.0 behavior, per the template's own description): HTTP 200 with an empty body (early exit).

Command (per run): nuclei -u http://127.0.0.1:<port> -t CVE-2026-112244.yaml -duc -ni -timeout 5 -retries 1 -debug

Results

Run	Target	Findings	Run-log SHA-256
Verifier A	vulnerable fixture	2 matcher hits (word-1, status-2)	`43279656bec8fea154fe5dfeb92334c500e3427e2ea6b5bfe6781f06eccf281b`
Verifier B	vulnerable fixture	2 matcher hits (word-1, status-2) — findings file byte-identical to A	`b7c7c4ae10a588a2dcaa52fe6ee682a5ab9068a6238b27473f46cccea9b349f1`
Verifier A	patched fixture	0 findings	`86523f4ab6b2f682029f01d89791b06a118051d76488e88638ed25f3b75ce8fe`
Verifier B	patched fixture	0 findings	`28115f35cf66dc997900efc7ad7123bf9483cc22a3d32e67b9bf2755f9b1d140`

Findings file SHA-256 (both vulnerable runs): 722e2d084aaeb5b3804e5603775f068b9d90c2aa0d6abaea81aaf70850403097

Verdict

PASS — both verifiers agree: the template triggers on the vulnerable response and stays silent on the patched response, matching its stated detection logic. No opinion on code style is expressed or implied.

Scope note: fixtures reproduce the vulnerable/patched HTTP responses described in the template and its cited advisory; this validates the template's matcher mechanics, not a live Duplicator installation.

Receipt hash (SHA-256 over template hash + all four run-log hashes, concatenated): a916e5cc611118714e786de8110171d1053854a2a132923752893a2ccb75a576