Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
| Account Takeover via Password Reset without user interactionsAnalysed#2293343 | Valid | Access Control | Critical | 2025-02-26 | $35,000 | 989 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | Command and Code Injection | Critical | 2019-12-19 | $12,000 | 777 |
| Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585 | Valid | Access Control | Critical | 2019-03-05 | $11,000 | 762 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | Command and Code Injection | Critical | 2019-07-17 | $12,000 | 542 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314 | Valid | Access Control | Critical | 2019-11-27 | $12,000 | 457 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| Remote Command Execution via Github importAnalysed#1679624 | Valid | Command and Code Injection | Critical | 2022-10-06 | $33,510 | 392 |
| RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Analysed#1609965 | Valid | Command and Code Injection | Critical | 2022-09-13 | $33,510 | 387 |
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsAnalysed#509924 | Valid | Information Disclosure | Critical | 2019-04-20 | $12,000 | 366 |
| SSRF on project import via the remote_attachment_url on a NoteAnalysed#826361 | Valid | Server-Side Request Forgery | High | 2020-06-07 | $10,000 | 359 |
| Arbitrary file read via the bulk imports UploadsPipelineAnalysed#1439593 | Valid | File and Path Handling | Critical | 2022-03-21 | $29,000 | 329 |
| Stored XSS in markdown via the DesignReferenceFilterAnalysed#1212067 | Valid | Cross-site Scripting | Critical | 2021-10-18 | $16,000 | 317 |
| An attacker can run pipeline jobs as arbitrary userAnalysed#894569 | Valid | Input Validation and Logic | Critical | 2020-08-26 | $12,000 | 307 |
| Stored XSS via Kroki diagramAnalysed#1731349 | Valid | Cross-site Scripting | High | 2023-06-02 | $13,950 | 295 |
| Cross-site Scripting (XSS) - Stored in RDoc wiki pagesAnalysed#662287 | Valid | Misconfiguration and Insecure Design | High | 2019-12-16 | $3,500 | 282 |
| Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAnalysed#922456 | Valid | Authentication | High | 2020-10-01 | $3,000 | 257 |
| Steal private objects of other projects via project importAnalysed#743953 | Valid | Insecure Direct Object Reference | Critical | 2022-06-07 | $20,000 | 254 |
| Unauthenticated blind SSRF in OAuth Jira authorization controllerAnalysed#398799 | Valid | Server-Side Request Forgery | High | 2019-03-14 | $4,000 | 238 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Git flag injection leading to file overwrite and potential remote code executionAnalysed#653125 | Valid | Command and Code Injection | Critical | 2019-12-19 | $3,500 | 169 |
| Snippet JS template allows attacker to read a user's private snippetsAnalysed#348443 | Valid | Information Disclosure | Low | 2019-03-03 | $300 | 165 |
| information disclosure of secret_key_base via encoding charctersAnalysed#460545 | Valid | Information Disclosure | High | 2019-06-13 | $3,500 | 146 |
| DoS on the Issue page by exploiting Mermaid.Analysed#470067 | Valid | Denial of Service | Medium | 2019-05-13 | $3,000 | 145 |
| Path traversal, to RCEAnalysed#733072 | Valid | Command and Code Injection | High | 2022-06-07 | $12,000 | 142 |
| Mint Oauth2 access token for targeted userAnalysed#1148364 | Valid | Authentication | High | 2025-07-23 | $5,580 | 140 |
| Persistent XSS in Note objectsAnalysed#508184 | Valid | Cross-site Scripting | High | 2019-07-19 | $4,500 | 139 |
| Private objects exposed through project importAnalysed#767770 | Valid | Insecure Direct Object Reference | Critical | 2022-06-07 | $20,000 | 133 |
| Stored XSS in custom emojiAnalysed#1198517 | Valid | Cross-site Scripting | High | 2021-07-19 | $3,000 | 130 |
| Git flag injection - Search API with scope 'blobs'Analysed#682442 | Valid | Command and Code Injection | High | 2019-12-15 | $7,000 | 130 |
| IDOR Exposes All Machine Learning ModelsAnalysed#2528293 | Valid | Insecure Direct Object Reference | Medium | 2024-10-01 | $1,160 | 117 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| XSS in request approvalsAnalysed#402658 | Valid | Cross-site Scripting | Medium | 2021-04-23 | $3,000 | 96 |
| New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsAnalysed#1578400 | Valid | Cross-site Scripting | High | 2022-11-16 | $13,950 | 93 |
| RepositoryPipeline allows importing of local git reposAnalysed#1685822 | Valid | Access Control | Medium | 2022-11-04 | $22,300 | 89 |
| Stored XSS in "Create Groups"Analysed#647130 | Valid | Cross-site Scripting | High | 2020-08-26 | $2,500 | 89 |
| CSRF on /api/graphql allows executing mutations through GET requestsAnalysed#1122408 | Valid | Cross-Site Request Forgery | High | 2021-08-02 | $3,370 | 88 |
| Path traversal in Nuget Package RegistryAnalysed#822262 | Valid | File and Path Handling | High | 2022-06-07 | $12,000 | 88 |
| DoS attack via comment on IssueAnalysed#557154 | Valid | Denial of Service | Low | 2019-11-21 | $1,000 | 84 |
| DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverAnalysed#2499070 | Valid | Denial of Service | Medium | 2024-10-09 | $2,300 | 64 |
| HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressAnalysed#1935628 | Valid | Injection and Smuggling | Low | 2024-10-08 | $1,060 | 61 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1106238 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 58 |
| EXIF metadata not stripped from JPG group logosAnalysed#446238 | Valid | Information Disclosure | Low | 2020-09-08 | $500 | 55 |
| Stored XSS in merge request pagesAnalysed#723307 | Valid | Cross-site Scripting | High | 2023-05-30 | $3,500 | 53 |
| All functions that allow users to specify color code are vulnerable to ReDoSAnalysed#511381 | Valid | Denial of Service | Low | 2019-08-21 | $1,000 | 53 |
| Change project visibility to a restricted optionAnalysed#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedAnalysed#1401444 | Valid | Command and Code Injection | – | 2022-04-12 | $3,000 | 50 |
| Stored XSS on the job pageAnalysed#856554 | Valid | Cross-site Scripting | High | 2021-01-08 | $3,000 | 50 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.