Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadAnalysed#1890284 | Valid | TikTok | File and Path Handling | Medium | 2023-04-12 | – | 118 |
| Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersAnalysed#833080 | Valid | Slack | File and Path Handling | High | 2020-06-30 | $1,500 | 101 |
| Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryAnalysed#3249624 | Valid | Nextcloud | File and Path Handling | Medium | 2025-10-16 | – | 63 |
| Path Traversal Vulnerability found on IBM CloudAnalysed#3060373 | Valid | IBM | File and Path Handling | Critical | 2025-05-07 | – | 63 |
| Path traversal by drive name in Windows environmentAnalysed#2307225 | Valid | Node.js | File and Path Handling | Medium | 2025-01-27 | – | 59 |
| LFI with potential to RCE on ██████ using CVE-2019-3396Analysed#538771 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2019-10-04 | – | 58 |
| Launchpad file read leaks production keysAnalysed#3962925 | Valid | Basecamp | File and Path Handling | Critical | 2026-10-28 | $9,337 | 55 |
| Path Traversal в iOS приложенииAnalysed#1050231 | Valid | VK.com | File and Path Handling | High | 2021-01-08 | $700 | 55 |
| Path traversal allows tricking the Talk Android app into writing files into it's root directoryAnalysed#1997029 | Valid | Nextcloud | File and Path Handling | Medium | 2023-08-14 | – | 43 |
| Path Traversal issue at https://████/blaze/Analysed#1320084 | Valid | Sony | File and Path Handling | High | 2022-10-06 | – | 40 |
| Path traversal via archive.extract - CVE 2021-3281 incomplete patchAnalysed#3328367 | Valid | Django | File and Path Handling | Low | 2025-11-21 | – | 38 |
| Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps.Analysed#1710541 | Valid | Basecamp | File and Path Handling | High | 2023-06-07 | – | 38 |
| Arbitrary read of all SVG files on a Nextcloud serverAnalysed#1302155 | Valid | Nextcloud | File and Path Handling | High | 2023-03-26 | $1,250 | 36 |
| Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Analysed#3160912 | Valid | Node.js | File and Path Handling | High | 2025-07-15 | – | 35 |
| Internal machine learning API endpoint for CWE classification is vulnerable to path traversalAnalysed#2032778 | Valid | HackerOne | File and Path Handling | Medium | 2023-07-05 | – | 33 |
| No validation to Image upload user can upload ( php APK zip files and can be used as storage purpose)Analysed#1644062 | Valid | Linktree | File and Path Handling | Medium | 2022-09-15 | $750 | 33 |
| LFI in pChart php libraryAnalysed#288298 | Valid | Valve | File and Path Handling | High | 2018-05-09 | – | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.