Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Path Traversal in mbstream ExtractAnalysed#3678395 | Valid | MariaDB | File and Path Handling | High | 2026-10-03 | – | 29 |
| 2 click Remote Code execution in Evernote AndroidAnalysed#1377748 | Valid | Evernote | File and Path Handling | High | 2022-03-29 | – | 30 |
| Path traversal in ZIP extract routine on LINE AndroidAnalysed#859469 | Valid | LY Corporation | File and Path Handling | Medium | 2020-11-17 | $475 | 33 |
| Unpacker improperly validates symlinks, allowing gems writes to arbitrary locationsAnalysed#270072 | Valid | RubyGems | File and Path Handling | Medium | 2018-12-31 | – | 35 |
| Delete directory using symlink when decompressing tarAnalysed#317321 | Valid | RubyGems | File and Path Handling | Medium | 2019-04-11 | $500 | 35 |
| Path traversal by monkey-patching Buffer internalsAnalysed#2218653 | Valid | Node.js | File and Path Handling | High | 2024-02-15 | – | 36 |
| Remote code execution via path traversal in Zip extraction in the Extract appAnalysed#765291 | Valid | Nextcloud | File and Path Handling | High | 2020-03-07 | – | 40 |
| Permission model improperly protects against path traversal in Node.js 20Analysed#2225660 | Valid | Internet Bug Bounty | File and Path Handling | High | 2023-11-30 | $2,330 | 42 |
| GitLab CI runner can read and poison cache of all other projectsAnalysed#301432 | Valid | GitLab | File and Path Handling | Critical | 2018-04-27 | $2,000 | 43 |
| Path traversal through path stored in Uint8Array in Node.js 20Analysed#2256167 | Valid | Internet Bug Bounty | File and Path Handling | High | 2024-01-20 | $3,495 | 44 |
| Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`Analysed#3931777 | Valid | WordPress | File and Path Handling | Critical | 2026-08-28 | – | 48 |
| [Android] Directory traversal leading to disclosure of auth tokensAnalysed#1378889 | Valid | Slack | File and Path Handling | High | 2022-02-25 | $3,500 | 50 |
| Git flag injection leads to arbitrary file writeAnalysed#1070247 | Valid | Phabricator | File and Path Handling | High | 2021-07-25 | – | 54 |
| Path traversal in Tempfile on windows OS due to unsanitized backslashesAnalysed#1131465 | Valid | Ruby | File and Path Handling | Medium | 2021-04-07 | – | 54 |
| [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAnalysed#1547877 | Valid | Aiven Ltd | File and Path Handling | Critical | 2022-11-08 | $5,000 | 56 |
| Arbitrary File WriteAnalysed#3384150 | Valid | arkadiyt-projects | File and Path Handling | High | 2025-10-19 | – | 56 |
| ActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionAnalysed#3580511 | Valid | Ruby on Rails | File and Path Handling | Medium | 2026-05-07 | – | 57 |
| MozillaVPN: Elevation of Privilege via a Logic VulnerabilityAnalysed#2686750 | Valid | Mozilla | File and Path Handling | Medium | 2025-07-03 | – | 60 |
| Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Analysed#2553411 | Valid | Basecamp | File and Path Handling | Medium | 2024-07-09 | – | 65 |
| Path traversal by monkey-patching Buffer internalsAnalysed#2434811 | Valid | Internet Bug Bounty | File and Path Handling | High | 2024-05-29 | $2,430 | 67 |
| Path traversal in Nuget Package RegistryAnalysed#822262 | Valid | GitLab | File and Path Handling | High | 2022-06-07 | $12,000 | 88 |
| Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAnalysed#1415820 | Valid | Aiven Ltd | File and Path Handling | High | 2021-12-14 | $1,000 | 105 |
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | Sony | File and Path Handling | High | 2026-06-05 | – | 109 |
| Payload delivery via Social Media urls on H1 profileAnalysed#2483422 | Valid | HackerOne | File and Path Handling | Medium | 2024-07-23 | – | 138 |
| Mozilla VPN Clients: RCE via file write and path traversalAnalysed#2995025 | Valid | Mozilla | File and Path Handling | High | 2025-07-29 | $6,000 | 173 |
| Path traversal in filename in LINE Mac clientAnalysed#727727 | Valid | LY Corporation | File and Path Handling | High | 2020-07-31 | – | 175 |
| Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279 | Valid | PortSwigger Web Security | File and Path Handling | High | 2026-06-14 | $5,000 | 176 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | GitLab | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataAnalysed#876295 | Valid | Starbucks | File and Path Handling | Critical | 2020-06-16 | – | 239 |
| Arbitrary file read via the bulk imports UploadsPipelineAnalysed#1439593 | Valid | GitLab | File and Path Handling | Critical | 2022-03-21 | $29,000 | 329 |
| [CVE-2022-44268] Arbitrary Remote Leak via ImageMagickAnalysed#1858574 | Valid | HackerOne | File and Path Handling | Critical | 2023-03-16 | – | 371 |
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | GitLab | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.