Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Path Traversal in App ProxyAnalysed#869888 | Valid | Shopify | File and Path Handling | Medium | 2020-08-24 | – | 29 |
| Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)Analysed#1400238 | Valid | Internet Bug Bounty | File and Path Handling | Critical | 2021-11-19 | $1,000 | 29 |
| [dev-nightly.ubnt.com] Local File ReadingAnalysed#260420 | Valid | Ubiquiti Inc. | File and Path Handling | High | 2017-09-14 | – | 31 |
| Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)Analysed#696276 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2024-06-18 | – | 31 |
| Windows only: arbitrary file read vulnerability in openssl s_serverAnalysed#850775 | Valid | Internet Bug Bounty | File and Path Handling | Medium | 2020-10-10 | – | 31 |
| Directory traversal at https://msg.algolia.comAnalysed#333306 | Valid | Algolia | File and Path Handling | Medium | 2018-06-09 | – | 34 |
| Non-authenticated path traversal leading to arbitrary file readAnalysed#1096043 | Valid | ExpressionEngine | File and Path Handling | High | 2024-05-28 | – | 34 |
| Unathenticated file read (CVE-2020-3452)Analysed#2233418 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2023-11-17 | – | 36 |
| Path Traversal on Default Installed Rails Application (Asset Pipeline)Analysed#307808 | Valid | Ruby on Rails | File and Path Handling | Medium | 2018-07-19 | $1,500 | 38 |
| CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.comAnalysed#1257100 | Valid | Uber | File and Path Handling | Medium | 2021-08-05 | – | 39 |
| Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storageAnalysed#3514640 | Valid | Rocket.Chat | File and Path Handling | High | 2026-08-03 | – | 47 |
| Limited LFIAnalysed#895972 | Valid | GSA Bounty | File and Path Handling | Medium | 2020-07-09 | $300 | 48 |
| ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)Analysed#257335 | Valid | Unikrn | File and Path Handling | Low | 2019-03-04 | $25 | 56 |
| CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]Analysed#2375666 | Valid | MTN Group | File and Path Handling | Critical | 2024-08-30 | – | 62 |
| jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`Analysed#3485343 | Valid | 8x8 | File and Path Handling | Low | 2026-07-02 | $100 | 68 |
| Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`Analysed#2778380 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2024-10-25 | – | 69 |
| CVE-2020-3187 - Unauthenticated Arbitrary File DeletionAnalysed#960330 | Valid | U.S. Dept Of Defense | File and Path Handling | Critical | 2020-09-21 | – | 70 |
| CVE-█████-35813 in █████Analysed#2200329 | Valid | Mars | File and Path Handling | Critical | 2026-02-24 | – | 71 |
| Grafana LFI on https://grafana.mariadb.orgAnalysed#1419213 | Valid | MariaDB | File and Path Handling | Medium | 2022-01-06 | – | 73 |
| Unrestricted File Upload at ██████████Analysed#2357778 | Valid | Mars | File and Path Handling | Critical | 2024-02-19 | – | 78 |
| File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220 | Valid | Ruby on Rails | File and Path Handling | High | 2020-07-13 | $1,000 | 80 |
| Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Analysed#780021 | Valid | Starbucks | File and Path Handling | Critical | 2020-03-10 | – | 81 |
| Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Analysed#1394916 | Valid | Internet Bug Bounty | File and Path Handling | Critical | 2021-11-09 | $4,000 | 96 |
| Path Traversal Vulnerability in Lila ProjectAnalysed#3181066 | Valid | Lichess | File and Path Handling | High | 2025-06-09 | – | 117 |
| [portswigger.net] Path Traversal al /cms/audioitemsAnalysed#2424815 | Valid | PortSwigger Web Security | File and Path Handling | High | 2024-04-04 | – | 146 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.