Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | Command and Code Injection | Critical | 2019-12-19 | $12,000 | 777 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | Command and Code Injection | Critical | 2019-07-17 | $12,000 | 542 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| Bypass of GitLab CI runner slash fix in YAML validationAnalysed#409395 | Valid | Input Validation and Logic | Critical | 2019-04-10 | – | 363 |
| Arbitrary file read via the bulk imports UploadsPipelineAnalysed#1439593 | Valid | File and Path Handling | Critical | 2022-03-21 | $29,000 | 329 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Importing GitLab project archives can replace uploads of other usersAnalysed#534794 | Valid | Insecure Direct Object Reference | High | 2019-12-11 | – | 148 |
| Path traversal, to RCEAnalysed#733072 | Valid | Command and Code Injection | High | 2022-06-07 | $12,000 | 142 |
| Read files on application server, leads to RCEAnalysed#178152 | Valid | Information Disclosure | Critical | 2016-11-03 | – | 114 |
| Path traversal in Nuget Package RegistryAnalysed#822262 | Valid | File and Path Handling | High | 2022-06-07 | $12,000 | 88 |
| GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionAnalysed#955016 | Valid | Command and Code Injection | High | 2020-11-04 | – | 77 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.