Day 1 — SessionReaper-style Vulnerable Lab (Educational)

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”): improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practice safely in Docker.

Quickstart

chmod +x entrypoint.sh
docker build -t day1-reaper .
docker run --rm -d -p 8080:80 --name day1 day1-reaper
# Visit http://localhost:8080/public/

! If you stuck you can use ./exploit.sh (after the container is running)