Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| SSRF on project import via the remote_attachment_url on a NoteAnalysed#826361 | Valid | Server-Side Request Forgery | High | 2020-06-07 | $10,000 | 359 |
| Server Side Request Forgery mitigation bypassAnalysed#632101 | Valid | Server-Side Request Forgery | High | 2020-04-18 | – | 350 |
| An attacker can run pipeline jobs as arbitrary userAnalysed#894569 | Valid | Input Validation and Logic | Critical | 2020-08-26 | $12,000 | 307 |
| Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAnalysed#922456 | Valid | Authentication | High | 2020-10-01 | $3,000 | 257 |
| Privilege escalation from any user (including external) to gitlab admin when admin impersonates youAnalysed#493324 | Valid | Access Control | Critical | 2020-08-26 | – | 256 |
| Send arbitrary PUT requests when user clicks on a linkAnalysed#824689 | Valid | Command and Code Injection | Medium | 2020-07-27 | – | 135 |
| Unrestricted file upload leads to Stored XSSAnalysed#880099 | Valid | Cross-site Scripting | Medium | 2020-08-03 | – | 90 |
| Stored XSS in "Create Groups"Analysed#647130 | Valid | Cross-site Scripting | High | 2020-08-26 | $2,500 | 89 |
| GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionAnalysed#955016 | Valid | Command and Code Injection | High | 2020-11-04 | – | 77 |
| EXIF metadata not stripped from JPG group logosAnalysed#446238 | Valid | Information Disclosure | Low | 2020-09-08 | $500 | 55 |
| Stored XSS in markdown when redacting referencesAnalysed#836649 | Valid | Cross-site Scripting | High | 2020-09-09 | $5,000 | 50 |
| XSS on Issue reference numbersAnalysed#831962 | Valid | Cross-site Scripting | Medium | 2020-11-23 | – | 49 |
| Stored XSS in blob viewerAnalysed#806571 | Valid | Cross-site Scripting | Medium | 2020-08-04 | – | 37 |
| Injection of `http.<url>.*` git config settings leading to SSRFAnalysed#855276 | Valid | Server-Side Request Forgery | High | 2020-09-08 | $3,000 | 36 |
| Store-XSS in error message of build-dependenciesAnalysed#950190 | Valid | Cross-site Scripting | High | 2020-12-01 | – | 35 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.