Intel · bug bounty

Disclosed bug bounty reports

Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.

SortMost upvoted

StatusAny

DisclosedAny year

WeaknessAny class

Access (analysis)A user account

TechniqueAny

GitLab Clear

25 of 15,219 reports · $303,470 in bounties · 227 analysed so far

#827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
#658013ValidAnalysedGit flag injection - local file overwrite to remote code executionGitLab · Command and Code Injection · 2019 · needs: a user account · OS command injection, Path traversal$12,000777votes
#446585ValidAnalysedExfiltrate and mutate repository and project data through injected templated serviceGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure, SSRF$11,000762votes
#526325ValidAnalysedStored XSS in Wiki pagesGitLab · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–633votes
#587854ValidAnalysedLocal files could be overwritten in GitLab, leading to remote command executionGitLab · Command and Code Injection · 2019 · needs: a user account · Path traversal, OS command injection$12,000542votes
#1154542ValidAnalysedRCE when removing metadata with ExifToolGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval, Unsafe file upload$20,000508votes
#689314ValidAnalysedProject Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, IDOR / object reference, Privilege escalation$12,000457votes
#1125425ValidAnalysedRCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval$20,000427votes
#850447ValidAnalysedgitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · Information Disclosure · 2020 · needs: a user account · Missing authorisation check, Information disclosure, Path traversal$10,000410votes
#1679624ValidAnalysedRemote Command Execution via Github importGitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection, Unsafe deserialisation$33,510392votes
#1609965ValidAnalysedRCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)GitLab · Command and Code Injection · 2022 · needs: a user account · OS command injection$33,510387votes
#509924ValidAnalysedJSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsGitLab · Information Disclosure · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check, Information disclosure, Leaked secret or key$12,000366votes
#409395ValidAnalysedBypass of GitLab CI runner slash fix in YAML validationGitLab · Input Validation and Logic · 2019 · needs: a user account · Path traversal, Business logic flaw–363votes
#826361ValidAnalysedSSRF on project import via the remote_attachment_url on a NoteGitLab · Server-Side Request Forgery · 2020 · needs: a user account · SSRF$10,000359votes
#502593ValidAnalysedAttacker is able to access commit title and team member comments which are supposed to be privateGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure–351votes
#632101ValidAnalysedServer Side Request Forgery mitigation bypassGitLab · Server-Side Request Forgery · 2020 · needs: a user account · SSRF, SSRF through a redirect–350votes
#1439593ValidAnalysedArbitrary file read via the bulk imports UploadsPipelineGitLab · File and Path Handling · 2022 · needs: a user account · Path traversal, Unsafe file upload, Information disclosure, Leaked secret or key$29,000329votes
#1212067ValidAnalysedStored XSS in markdown via the DesignReferenceFilterGitLab · Cross-site Scripting · 2021 · needs: a user account · Stored XSS, CSP bypass$16,000317votes
#894569ValidAnalysedAn attacker can run pipeline jobs as arbitrary userGitLab · Input Validation and Logic · 2020 · needs: a user account · Privilege escalation, Business logic flaw$12,000307votes
#1731349ValidAnalysedStored XSS via Kroki diagramGitLab · Cross-site Scripting · 2023 · needs: a user account · Stored XSS, HTML injection$13,950295votes
#662287ValidAnalysedCross-site Scripting (XSS) - Stored in RDoc wiki pagesGitLab · Misconfiguration and Insecure Design · 2019 · needs: a user account · HTML injection, Business logic flaw$3,500282votes
#922456ValidAnalysedAbility to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesGitLab · Authentication · 2020 · needs: a user account · Authentication bypass, E-mail verification bypass, Account takeover chain$3,000257votes
#493324ValidAnalysedPrivilege escalation from any user (including external) to gitlab admin when admin impersonates youGitLab · Access Control · 2020 · needs: a user account · Privilege escalation, Session fixation or reuse–256votes
#743953ValidAnalysedSteal private objects of other projects via project importGitLab · Insecure Direct Object Reference · 2022 · needs: a user account · IDOR / object reference, Mass assignment$20,000254votes
#565883ValidAnalysedBypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainGitLab · Input Validation and Logic · 2019 · needs: a user account · E-mail verification bypass, Authentication bypass–249votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.