Congrats!

Ignoring OP's config fuck-up, I think you did a service to the world, showing this vulnerability is very much real.

awww my kimi says the thingy they made wouldn't work and would take a lot of effort to fix... sadsad. still, i never even thought of finding the container and binary of the server. very cool of you. (╥ ᴗ ╥)

Well done. It’s important to know the difference between a real world exploitable bug and hot air; as an open source maintainer, over half of the bug reports I get are “hot air” bugs.