Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| PHP builded for Windows with TS support does not resolve relalative paths with drive letter correctly#797159 | Valid | Internet Bug Bounty | File and Path Handling | Medium | 2020-11-09 | – | – |
| Access to admininstrative resources/account via path traversal#1326352 | Valid | U.S. Dept Of Defense | File and Path Handling | Critical | 2022-09-06 | – | – |
| [statics-server] Path Traversal due to lack of provided path sanitization#355456 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-04-03 | – | 1 |
| [servey] Path Traversal allows to retrieve content of any file with extension from remote server#355501 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-04-03 | – | 1 |
| [https://███] Local File Inclusion via graph.php#492767 | Valid | U.S. Dept Of Defense | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| [deliver-or-else] Path Traversal#507310 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-01-29 | – | 1 |
| [md-fileserver] Path Traversal#509697 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-01-29 | – | 1 |
| [██████████] — Directory traversal via `/aerosol-bin/███████/display_directory_████_t.cgi`#686343 | Valid | U.S. Dept Of Defense | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| [sirloin] Web Server Directory Traversal via Crafted GET Request#790623 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-08-30 | – | 1 |
| [hangersteak] Web Server Directory Traversal via Crafted GET Request#790873 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-08-30 | – | 1 |
| https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability#940384 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2020-08-13 | – | 1 |
| [zenn-cli] Path traversal on Windows allows the attacker to read arbitrary .md files#993975 | Valid | Node.js third-party modules | File and Path Handling | Low | 2020-10-29 | – | 1 |
| "blog.skillfactory.ru" Vulnerable to Directory Traversal#1021010 | No longer public | Mail.ru | File and Path Handling | – | 2021-04-06 | – | 1 |
| [CVE-2020-3452] Unauthenticated file read in Cisco ASA#1415825 | Valid | U.S. Dept Of Defense | File and Path Handling | Critical | 2022-02-14 | – | 1 |
| CVE-2020-3452 on https://█████/#1455257 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2022-03-18 | – | 1 |
| Arbitrary File Deletion (CVE-2020-3187) on ████████#1455266 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2022-03-18 | – | 1 |
| full path disclosure at hosted.weblate.org/admin/accounts/profile/#225495 | Valid | Weblate | File and Path Handling | Medium | 2017-05-17 | – | 2 |
| [m-server] Path Traversal allows to display content of arbitrary file(s) from the server#319795 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2018-07-12 | – | 2 |
| [http-live-simulator] Path traversal vulnerability#411405 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-12-28 | – | 2 |
| [http_server] Path Traversal allowing to read any files on the server#579523 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-09-24 | – | 2 |
| [static-server-gx] Path Traversal allowing to read any files on the server#581939 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-09-03 | – | 2 |
| Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package#730239 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2020-02-15 | – | 2 |
| [node-downloader-helper] Path traversal via Content-Disposition header#772509 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2020-11-11 | – | 2 |
| Stored XSS on ████████helpdesk#901799 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2020-07-30 | – | 2 |
| [augustine] Static Web Server Directory Traversal via Crafted GET Request#296282 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2018-01-23 | – | 3 |
| [lactate] Static Web Server Directory Traversal via Crafted GET Request#296645 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2018-01-23 | – | 3 |
| [file-static-server] Path Traversal allows to read content of arbitrary file on the server#310671 | Valid | Node.js third-party modules | File and Path Handling | Low | 2018-06-14 | – | 3 |
| [public] Path traversal using symlink#593911 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-08-28 | – | 3 |
| Path traversal in https://www.npmjs.com/package/http_server via symlink#692262 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-12-04 | – | 3 |
| https://██████/ Vulnerable to CVE-2013-3827 (Directory-traversal vulnerability)#1280188 | Valid | U.S. Dept Of Defense | File and Path Handling | Medium | 2021-08-26 | – | 3 |
| [CVE-2020-3452] Unauthenticated file read in Cisco ASA#1555021 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2022-05-12 | – | 3 |
| Directory Traversal at █████#1641148 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2022-09-14 | – | 3 |
| CVE-2023-27534: SFTP path ~ resolving discrepancy#1892351 | Valid | curl | File and Path Handling | Low | 2023-03-22 | – | 3 |
| [serve-here] Static Web Server Directory Traversal via Crafted GET Request#296254 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2018-01-10 | – | 4 |
| [featurebook] Specification Server Directory Traversal via Crafted Browser Request#296305 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2018-01-10 | – | 4 |
| [public] Path Traversal allows to read content of arbitrary files#312918 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-02-17 | – | 4 |
| Bypass to defective fix of Path Traversal#329837 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-05-11 | – | 4 |
| [angular-http-server] Server Directory Traversal#330349 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-04-26 | – | 4 |
| [localhost-now] bypassing url filter which leads to read content of arbitrary file#334837 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-05-30 | – | 4 |
| [ponse] Path traversal in ponse module allows to read any file on server#383112 | Valid | Node.js third-party modules | File and Path Handling | High | 2018-07-20 | – | 4 |
| [harp] Path traversal using symlink#530289 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-04-09 | – | 4 |
| [hnzserver] Path Traversal allowing to read any files on the server#579517 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-09-24 | – | 4 |
| Path traversal in command line client#637840 | Valid | MariaDB | File and Path Handling | Medium | 2020-05-28 | – | 4 |
| [sapper] Path Traversal#820224 | Valid | Node.js third-party modules | File and Path Handling | High | 2020-06-18 | – | 4 |
| [██████████.mil] Cisco VPN Service Path Traversal#943717 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2020-10-16 | – | 4 |
| [CVE-2020-3452] Unauthenticated file read in Cisco ASA#951530 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2020-10-16 | – | 4 |
| Read-only path traversal (CVE-2020-3452) at https://████████#959679 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2021-04-02 | – | 4 |
| Read-only path traversal (CVE-2020-3452) at https://█████#960082 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2021-04-02 | – | 4 |
| [CVE-2020-3452] Unauthenticated file read in Cisco ASA#1555015 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2022-05-12 | – | 4 |
| Off-by-slash vulnerability in nodejs.org and iojs.org#1650273 | Valid | Internet Bug Bounty | File and Path Handling | Medium | 2022-07-28 | $1,200 | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.