Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | GitLab | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
| [CVE-2022-44268] Arbitrary Remote Leak via ImageMagickAnalysed#1858574 | Valid | HackerOne | File and Path Handling | Critical | 2023-03-16 | – | 371 |
| SSRF & LFR via on city-mobil.ru#748123 | No longer public | Mail.ru | File and Path Handling | – | 2020-04-14 | – | 343 |
| Arbitrary file read via the bulk imports UploadsPipelineAnalysed#1439593 | Valid | GitLab | File and Path Handling | Critical | 2022-03-21 | $29,000 | 329 |
| Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataAnalysed#876295 | Valid | Starbucks | File and Path Handling | Critical | 2020-06-16 | – | 239 |
| Keybase client (Windows 10): Write files anywhere in userland using relative path in "download attachement" feature#713006 | No longer public | Keybase | File and Path Handling | – | 2020-06-26 | $5,000 | 196 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | GitLab | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279 | Valid | PortSwigger Web Security | File and Path Handling | High | 2026-06-14 | $5,000 | 176 |
| Path traversal in filename in LINE Mac clientAnalysed#727727 | Valid | LY Corporation | File and Path Handling | High | 2020-07-31 | – | 175 |
| Mozilla VPN Clients: RCE via file write and path traversalAnalysed#2995025 | Valid | Mozilla | File and Path Handling | High | 2025-07-29 | $6,000 | 173 |
| RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928 | Valid | WordPress | File and Path Handling | Critical | 2020-06-09 | – | 164 |
| [portswigger.net] Path Traversal al /cms/audioitemsAnalysed#2424815 | Valid | PortSwigger Web Security | File and Path Handling | High | 2024-04-04 | – | 146 |
| Payload delivery via Social Media urls on H1 profileAnalysed#2483422 | Valid | HackerOne | File and Path Handling | Medium | 2024-07-23 | – | 138 |
| Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadAnalysed#1890284 | Valid | TikTok | File and Path Handling | Medium | 2023-04-12 | – | 118 |
| Path Traversal Vulnerability in Lila ProjectAnalysed#3181066 | Valid | Lichess | File and Path Handling | High | 2025-06-09 | – | 117 |
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | Sony | File and Path Handling | High | 2026-06-05 | – | 109 |
| Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAnalysed#1415820 | Valid | Aiven Ltd | File and Path Handling | High | 2021-12-14 | $1,000 | 105 |
| Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersAnalysed#833080 | Valid | Slack | File and Path Handling | High | 2020-06-30 | $1,500 | 101 |
| Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Analysed#1394916 | Valid | Internet Bug Bounty | File and Path Handling | Critical | 2021-11-09 | $4,000 | 96 |
| Path traversal in Nuget Package RegistryAnalysed#822262 | Valid | GitLab | File and Path Handling | High | 2022-06-07 | $12,000 | 88 |
| Avatar upload allows arbitrary file overwriting#671605 | No longer public | Mail.ru | File and Path Handling | – | 2019-09-28 | $750 | 88 |
| Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution Vulnerability#411140 | No longer public | Vanilla | File and Path Handling | – | 2019-03-13 | $900 | 84 |
| Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Analysed#780021 | Valid | Starbucks | File and Path Handling | Critical | 2020-03-10 | – | 81 |
| File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220 | Valid | Ruby on Rails | File and Path Handling | High | 2020-07-13 | $1,000 | 80 |
| Unrestricted File Upload at ██████████Analysed#2357778 | Valid | Mars | File and Path Handling | Critical | 2024-02-19 | – | 78 |
| Path traversal lead to LFR via [CVE-2019-3394]#980881 | No longer public | Mail.ru | File and Path Handling | – | 2021-05-12 | – | 74 |
| Grafana LFI on https://grafana.mariadb.orgAnalysed#1419213 | Valid | MariaDB | File and Path Handling | Medium | 2022-01-06 | – | 73 |
| CVE-█████-35813 in █████Analysed#2200329 | Valid | Mars | File and Path Handling | Critical | 2026-02-24 | – | 71 |
| CVE-2020-3187 - Unauthenticated Arbitrary File DeletionAnalysed#960330 | Valid | U.S. Dept Of Defense | File and Path Handling | Critical | 2020-09-21 | – | 70 |
| Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`Analysed#2778380 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2024-10-25 | – | 69 |
| jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`Analysed#3485343 | Valid | 8x8 | File and Path Handling | Low | 2026-07-02 | $100 | 68 |
| Path traversal by monkey-patching Buffer internalsAnalysed#2434811 | Valid | Internet Bug Bounty | File and Path Handling | High | 2024-05-29 | $2,430 | 67 |
| Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Analysed#2553411 | Valid | Basecamp | File and Path Handling | Medium | 2024-07-09 | – | 65 |
| Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet LibraryAnalysed#3249624 | Valid | Nextcloud | File and Path Handling | Medium | 2025-10-16 | – | 63 |
| Path Traversal Vulnerability found on IBM CloudAnalysed#3060373 | Valid | IBM | File and Path Handling | Critical | 2025-05-07 | – | 63 |
| CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]Analysed#2375666 | Valid | MTN Group | File and Path Handling | Critical | 2024-08-30 | – | 62 |
| MozillaVPN: Elevation of Privilege via a Logic VulnerabilityAnalysed#2686750 | Valid | Mozilla | File and Path Handling | Medium | 2025-07-03 | – | 60 |
| Path traversal by drive name in Windows environmentAnalysed#2307225 | Valid | Node.js | File and Path Handling | Medium | 2025-01-27 | – | 59 |
| LFI with potential to RCE on ██████ using CVE-2019-3396Analysed#538771 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2019-10-04 | – | 58 |
| ActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionAnalysed#3580511 | Valid | Ruby on Rails | File and Path Handling | Medium | 2026-05-07 | – | 57 |
| Arbitrary File WriteAnalysed#3384150 | Valid | arkadiyt-projects | File and Path Handling | High | 2025-10-19 | – | 56 |
| [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAnalysed#1547877 | Valid | Aiven Ltd | File and Path Handling | Critical | 2022-11-08 | $5,000 | 56 |
| ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)Analysed#257335 | Valid | Unikrn | File and Path Handling | Low | 2019-03-04 | $25 | 56 |
| Launchpad file read leaks production keysAnalysed#3962925 | Valid | Basecamp | File and Path Handling | Critical | 2026-10-28 | $9,337 | 55 |
| Path Traversal в iOS приложенииAnalysed#1050231 | Valid | VK.com | File and Path Handling | High | 2021-01-08 | $700 | 55 |
| Path traversal in Tempfile on windows OS due to unsanitized backslashesAnalysed#1131465 | Valid | Ruby | File and Path Handling | Medium | 2021-04-07 | – | 54 |
| Git flag injection leads to arbitrary file writeAnalysed#1070247 | Valid | Phabricator | File and Path Handling | High | 2021-07-25 | – | 54 |
| [Android] Directory traversal leading to disclosure of auth tokensAnalysed#1378889 | Valid | Slack | File and Path Handling | High | 2022-02-25 | $3,500 | 50 |
| Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`Analysed#3931777 | Valid | WordPress | File and Path Handling | Critical | 2026-08-28 | – | 48 |
| Limited LFIAnalysed#895972 | Valid | GSA Bounty | File and Path Handling | Medium | 2020-07-09 | $300 | 48 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.