Arbitrary file read via the UploadsRewriter when moving and issue Analysed #827052 Valid File and Path Handling – 2020-04-27 $20,000 1,503 Account Takeover via Password Reset without user interactions Analysed #2293343 Valid Access Control Critical 2025-02-26 $35,000 989 Git flag injection - local file overwrite to remote code execution Analysed #658013 Valid Command and Code Injection – 2019-12-19 $12,000 777 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control – 2019-03-05 $11,000 762 Stored XSS in Wiki pages Analysed #526325 Valid Cross-site Scripting – 2019-09-02 – 633 Local files could be overwritten in GitLab, leading to remote command execution Analysed #587854 Valid Command and Code Injection – 2019-07-17 $12,000 542 RCE when removing metadata with ExifTool Analysed #1154542 Valid Command and Code Injection – 2021-05-14 $20,000 508 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control – 2019-11-27 $12,000 457 RCE via unsafe inline Kramdown options when rendering certain Wiki pages Analysed #1125425 Valid Command and Code Injection – 2021-04-20 $20,000 427 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure – 2020-06-08 $10,000 410 Remote Command Execution via Github import Analysed #1679624 Valid Command and Code Injection – 2022-10-06 $33,510 392 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) Analysed #1609965 Valid Command and Code Injection – 2022-09-13 $33,510 387 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure – 2019-04-20 $12,000 366 Bypass of GitLab CI runner slash fix in YAML validation Analysed #409395 Valid Input Validation and Logic – 2019-04-10 – 363 SSRF on project import via the remote_attachment_url on a Note Analysed #826361 Valid Server-Side Request Forgery – 2020-06-07 $10,000 359 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control – 2019-07-03 – 351 Server Side Request Forgery mitigation bypass Analysed #632101 Valid Server-Side Request Forgery – 2020-04-18 – 350 Arbitrary file read via the bulk imports UploadsPipeline Analysed #1439593 Valid File and Path Handling – 2022-03-21 $29,000 329 Stored XSS in markdown via the DesignReferenceFilter Analysed #1212067 Valid Cross-site Scripting – 2021-10-18 $16,000 317 An attacker can run pipeline jobs as arbitrary user Analysed #894569 Valid Input Validation and Logic – 2020-08-26 $12,000 307 Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com Analysed #498964 Valid Access Control – 2019-04-19 – 306 Stored XSS via Kroki diagram Analysed #1731349 Valid Cross-site Scripting – 2023-06-02 $13,950 295 Cross-site Scripting (XSS) - Stored in RDoc wiki pages Analysed #662287 Valid Misconfiguration and Insecure Design – 2019-12-16 $3,500 282 RCE via github import #1672388 Valid Command and Code Injection – 2022-11-16 – 271 Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties Analysed #922456 Valid Authentication – 2020-10-01 $3,000 257 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control – 2020-08-26 – 256 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 254 Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic – 2019-08-30 – 249 Unauthenticated blind SSRF in OAuth Jira authorization controller Analysed #398799 Valid Server-Side Request Forgery – 2019-03-14 $4,000 238 Full Read SSRF on Gitlab's Internal Grafana #878779 Valid Server-Side Request Forgery – 2020-08-07 – 229 Ability To Delete User(s) Account Without User Interaction #928255 Valid Misconfiguration and Insecure Design – 2021-03-17 – 221 Group search leaks private MRs, code, commits #692252 Valid Access Control – 2019-12-14 – 212 Arbitrary file read during project import #1132378 Valid File and Path Handling – 2021-05-24 $16,000 194 Stored-XSS with CSP-bypass via labels' color #1665658 Valid Cross-site Scripting – 2023-02-19 – 169 Git flag injection leading to file overwrite and potential remote code execution #653125 Valid Command and Code Injection – 2019-12-19 $3,500 169 Snippet JS template allows attacker to read a user's private snippets #348443 Valid Information Disclosure – 2019-03-03 $300 165 Stored XSS in Notes (with CSP bypass for gitlab.com) #1481207 Valid Cross-site Scripting – 2022-05-25 – 161 Importing GitLab project archives can replace uploads of other users #534794 Valid Insecure Direct Object Reference – 2019-12-11 – 148 information disclosure of secret_key_base via encoding charcters #460545 Valid Information Disclosure – 2019-06-13 $3,500 146 DoS on the Issue page by exploiting Mermaid. #470067 Valid Denial of Service – 2019-05-13 $3,000 145 Path traversal, to RCE #733072 Valid Command and Code Injection – 2022-06-07 $12,000 142 Mint Oauth2 access token for targeted user #1148364 Valid Authentication High 2025-07-23 $5,580 140 Persistent XSS in Note objects #508184 Valid Cross-site Scripting – 2019-07-19 $4,500 139 Send arbitrary PUT requests when user clicks on a link #824689 Valid Command and Code Injection – 2020-07-27 – 135 Private objects exposed through project import #767770 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 133 Stored XSS in custom emoji #1198517 Valid Cross-site Scripting – 2021-07-19 $3,000 130 Git flag injection - Search API with scope 'blobs' #682442 Valid Command and Code Injection – 2019-12-15 $7,000 130 IDOR Exposes All Machine Learning Models #2528293 Valid Insecure Direct Object Reference Medium 2024-10-01 $1,160 117 Read files on application server, leads to RCE #178152 Valid Information Disclosure – 2016-11-03 – 114 Able to view hackerone reports attachments #979787 Valid Information Disclosure – 2022-07-11 – 103