Disclosed bug bounty reports

297 of 15,219 reports · $153,324 in bounties · 161 analysed so far

• #827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
• #1858574ValidAnalysed[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickHackerOne · File and Path Handling · 2023 · needs: a user account · Local file inclusion, Unsafe file upload, Information disclosure, Leaked secret or key–371votes
• #748123ValidSSRF & LFR via on city-mobil.ruMail.ru · File and Path Handling · 2020–343votes
• #1439593ValidAnalysedArbitrary file read via the bulk imports UploadsPipelineGitLab · File and Path Handling · 2022 · needs: a user account · Path traversal, Unsafe file upload, Information disclosure, Leaked secret or key$29,000329votes
• #808862Not checked yetUnrestricted file upload leads to Stored XSSVisma Public · File and Path Handling$250268votes
• #876295ValidMisuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataStarbucks · File and Path Handling · 2020–239votes
• #713006ValidKeybase client (Windows 10): Write files anywhere in userland using relative path in "download attachement" featureKeybase · File and Path Handling · 2020$5,000196votes
• #1132378ValidArbitrary file read during project importGitLab · File and Path Handling · 2021$16,000194votes
• #3712279ValidBurp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPortSwigger Web Security · File and Path Handling · 2026 · High$5,000176votes
• #727727ValidPath traversal in filename in LINE Mac clientLY Corporation · File and Path Handling · 2020–175votes
• #2995025ValidMozilla VPN Clients: RCE via file write and path traversalMozilla · File and Path Handling · 2025 · High$6,000173votes
• #436928ValidRCE as Admin defeats WordPress hardening and file permissionsWordPress · File and Path Handling · 2020–164votes
• #2424815Valid[portswigger.net] Path Traversal al /cms/audioitemsPortSwigger Web Security · File and Path Handling · 2024–146votes
• #2483422ValidPayload delivery via Social Media urls on H1 profileHackerOne · File and Path Handling · 2024 · Medium–138votes
• #1890284ValidUnrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadTikTok · File and Path Handling · 2023–118votes
• #3181066ValidPath Traversal Vulnerability in Lila ProjectLichess · File and Path Handling · 2025 · High–117votes
• #3355766ValidDLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Sony · File and Path Handling · 2026 · High–109votes
• #1415820ValidZero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAiven Ltd · File and Path Handling · 2021 · no account (title)$1,000105votes
• #833080ValidTricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersSlack · File and Path Handling · 2020$1,500101votes
• #1394916ValidPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Internet Bug Bounty · File and Path Handling · 2021$4,00096votes
• #822262ValidPath traversal in Nuget Package RegistryGitLab · File and Path Handling · 2022$12,00088votes
• #671605ValidAvatar upload allows arbitrary file overwritingMail.ru · File and Path Handling · 2019$75088votes
• #411140ValidVanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution VulnerabilityVanilla · File and Path Handling · 2019$90084votes
• #780021ValidKorea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Starbucks · File and Path Handling · 2020–81votes
• #519220ValidFile writing by Directory traversal at actionpack-page_caching and RCE by itRuby on Rails · File and Path Handling · 2020$1,00080votes
• #2357778ValidUnrestricted File Upload at ██████████Mars · File and Path Handling · 2024–78votes
• #1860380No longer publicPUT Based CSRF via Client Side Path Traversal + Cookie Bomb on Acronis CloudAcronis · File and Path Handling$60076votes
• #980881ValidPath traversal lead to LFR via [CVE-2019-3394]Mail.ru · File and Path Handling · 2021–74votes
• #1419213ValidGrafana LFI on https://grafana.mariadb.orgMariaDB · File and Path Handling · 2022–73votes
• #2200329ValidCVE-█████-35813 in █████Mars · File and Path Handling · 2026 · Critical–71votes
• #960330ValidCVE-2020-3187 - Unauthenticated Arbitrary File DeletionU.S. Dept Of Defense · File and Path Handling · 2020 · no account (title)–70votes
• #2778380ValidUnauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`U.S. Dept Of Defense · File and Path Handling · 2024 · High · no account (title)–69votes
• #996899Not checked yetLFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much moreBugPoC · File and Path Handling$10069votes
• #3485343Validjitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`8x8 · File and Path Handling · 2026 · Low · no account (title)$10068votes
• #2434811ValidPath traversal by monkey-patching Buffer internalsInternet Bug Bounty · File and Path Handling · 2024 · High$2,43067votes
• #2553411ValidPath traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Basecamp · File and Path Handling · 2024 · Medium–65votes
• #3249624ValidPath Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryNextcloud · File and Path Handling · 2025 · Medium–63votes
• #3060373ValidPath Traversal Vulnerability found on IBM CloudIBM · File and Path Handling · 2025 · Critical–63votes
• #2375666ValidCVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]MTN Group · File and Path Handling · 2024 · Critical–62votes
• #2686750ValidMozillaVPN: Elevation of Privilege via a Logic VulnerabilityMozilla · File and Path Handling · 2025 · Medium–60votes
• #2307225ValidPath traversal by drive name in Windows environmentNode.js · File and Path Handling · 2025 · Medium–59votes
• #538771ValidLFI with potential to RCE on ██████ using CVE-2019-3396U.S. Dept Of Defense · File and Path Handling · 2019–58votes
• #3580511ValidActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionRuby on Rails · File and Path Handling · 2026 · Medium–57votes
• #1132160No longer publicPath Traversal in dict-fs and no-check Escape Character in oauth2-jwtOpen-Xchange · File and Path Handling$98257votes
• #788397Not checked yetUnrestricted file upload when creating quotes allows for Stored XSSVisma Public · File and Path Handling$25057votes
• #3384150ValidArbitrary File Writearkadiyt-projects · File and Path Handling · 2025 · High–56votes
• #1547877Valid[Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAiven Ltd · File and Path Handling · 2022$5,00056votes
• #257335Validssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)Unikrn · File and Path Handling · 2019 · a user account (title)$2556votes
• #3962925ValidLaunchpad file read leaks production keysBasecamp · File and Path Handling · 2026 · Critical$9,33755votes
• #1050231ValidPath Traversal в iOS приложенииVK.com · File and Path Handling · 2021$70055votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.