Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessFile and Path Handling
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
7 of 15,219 reports · 161 analysed so far
- #2307225ValidPath traversal by drive name in Windows environmentNode.js · File and Path Handling · 2025 · Medium–59votes
- #3255707InformativeWindows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixNode.js · File and Path Handling · 2025 · High–39votes
- #2218653ValidPath traversal by monkey-patching Buffer internalsNode.js · File and Path Handling · 2024–36votes
- #3160912ValidWindows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Node.js · File and Path Handling · 2025 · High–35votes
- #2259914ValidMultiple permission model bypasses due to improper path traversal sequence sanitizationNode.js · File and Path Handling · 2024–20votes
- #1631350ValidOff-by-slash vulnerability in nodejs.org and iojs.orgNode.js · File and Path Handling · 2022–12votes
- #1952978ValidFilesystem experimental permissions policy does not handle path traversal cases.Node.js · File and Path Handling · 2023–5votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.