Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220	Valid	File and Path Handling	High	2020-07-13	$1,000	80
XSS vulnerabilities due to missing checks in tag helpersAnalysed#1444151	Valid	Cross-site Scripting	Medium	2023-07-28	–	41
RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Analysed#473888	Valid	Command and Code Injection	High	2019-03-13	$1,500	41
Path Traversal on Default Installed Rails Application (Asset Pipeline)Analysed#307808	Valid	File and Path Handling	Medium	2018-07-19	$1,500	38
DoS with crafted "Range" headerAnalysed#2307813	Valid	No weakness recorded	High	2024-06-25	–	24
Open Redirect (6.0.0 < rails < 6.0.3.2)Analysed#904059	Valid	Open Redirect	High	2020-12-22	$1,000	19
ReDoS in Rack::MultipartAnalysed#1489141	Valid	No weakness recorded	High	2023-07-28	–	18
Subdomain Takeover at https://new.rubyonrails.org/Analysed#1429148	Valid	Access Control	High	2022-03-03	–	17
Specially constructed multi-part requests cause multi-second response times; vulnerable to DoSAnalysed#431561	Valid	No weakness recorded	Medium	2018-12-05	–	17
Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.Analysed#1955370	Valid	Cross-site Scripting	Medium	2023-07-28	–	15
RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1Analysed#44513	Valid	Command and Code Injection	–	2015-06-16	–	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.