Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | Command and Code Injection | – | 2021-05-14 | $20,000 | 508 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | Command and Code Injection | – | 2019-07-17 | $12,000 | 542 |
| Stored XSS in Wiki pagesAnalysed#526325 | Valid | Cross-site Scripting | – | 2019-09-02 | – | 633 |
| Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585 | Valid | Access Control | – | 2019-03-05 | $11,000 | 762 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | Command and Code Injection | – | 2019-12-19 | $12,000 | 777 |
| Account Takeover via Password Reset without user interactionsAnalysed#2293343 | Valid | Access Control | Critical | 2025-02-26 | $35,000 | 989 |
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | File and Path Handling | – | 2020-04-27 | $20,000 | 1,503 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.