Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessFile and Path Handling
Access (analysis)A user account
TechniqueAny
2 of 15,219 reports · $49,000 in bounties · 227 analysed so far
- #827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
- #1439593ValidAnalysedArbitrary file read via the bulk imports UploadsPipelineGitLab · File and Path Handling · 2022 · needs: a user account · Path traversal, Unsafe file upload, Information disclosure, Leaked secret or key$29,000329votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.