Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.
HackerOneWeblate2026-10-30
Web
Medium
BUG BOUNTY WRITEUPS
Path traversal and LFI writeups
Reading files you shouldn't: directory traversal, local file inclusion and arbitrary file read, from simple ../ payloads to encoding and parser tricks.
112 reports and writeups from 2024 to 2026. 62 carry a severity from the disclosing platform, 36 of them rated High or Critical. Last updated 2026-10-30.
Latest Path traversal and LFI reports
Search and filter all writeupsLaunchpad file read leaks production keys
HackerOneBasecamp2026-10-28$9,337 bounty
Web
Critical
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
Researcher blog2026-10-06
Web
Not rated
Path Traversal in mbstream Extract
HackerOneMariaDB2026-10-03
Web
High
[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames
HackerOnecurl2026-09-26
Web
High
22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal
HackerOnecurl2026-09-08
Web
Not rated
CVE-2026-80256: wcurl backslash bypass
HackerOnecurl2026-09-02
Web
Medium
Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/ /finalize` poisoning `_wp_attachment_metadata`
HackerOneWordPress2026-08-28
Web
Critical
Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider
HackerOneNextcloud2026-08-24
Android, Cloud
Medium
Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage
HackerOneRocket.Chat2026-08-03
Web
High
Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete Fix
HackerOneRuby on Rails2026-07-30
Web
High
jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`
HackerOne8x82026-07-02$100 bounty
Web, API
Low
Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling
HackerOnePortSwigger Web Security2026-06-14$5,000 bounty
Web
High
ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection
HackerOneRuby on Rails2026-05-07
Web
Medium
Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes
HackerOnearkadiyt-projects2026-03-31
Web
Medium
Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter
HackerOneLovable VDP2026-03-12
Web
Medium
CVE-█████-35813 in █████
HackerOneMars2026-02-24
Web
Critical
Path Traversal vulnerability identified on IBM endpoint.
HackerOneIBM2026-01-12
Web, API
High
inconsistently Rejection Logic in file:// URLs with Authority
HackerOnecurl2026-01-08
Web
Low
Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
HackerOnecurl2026-01-04
Web
High
Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization
HackerOnecurl2025-12-15
Web
High
Path Traversal in file:// protocol allows Arbitrary File Read
HackerOnecurl2025-12-01
Web
High
Path traversal via archive.extract - CVE 2021-3281 incomplete patch
HackerOneDjango2025-11-21
Web
Low
libcurl FTP path normalization flaw allows decoded %2e%2e → CWD .. and directory escape (Path Traversal, CWE-22)
HackerOnecurl2025-11-11
Web
High
Directory Traversal Vulnerability in cURL via Content-Disposition Header Processing
HackerOnecurl2025-11-01
Web
Medium
Arbitrary File Write
HackerOnearkadiyt-projects2025-10-19
Web
High
Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library
HackerOneNextcloud2025-10-16
Web, Cloud
Medium
Vulnerability Report: Local File Disclosure via file:// Protocol in cURL
HackerOnecurl2025-08-10
Web
Medium
Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE
HackerOnecurl2025-08-10
Web
Critical
Mozilla VPN Clients: RCE via file write and path traversal
HackerOneMozilla2025-07-29$6,000 bounty
Web
High
Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix
HackerOneNode.js2025-07-28
Windows
High
Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()
HackerOneNode.js2025-07-15
Windows
High
Arbitrary File Read via file:// Protocol in cURL
HackerOnecurl2025-07-09
Web
Critical
arbitrary file read via `file://` path traversal with `--path-as-is`
HackerOnecurl2025-07-01
Web
Medium
[High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)
HackerOnecurl2025-06-30
Web
High
Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable
HackerOnecurl2025-06-28
Web
High
Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure
HackerOnecurl2025-06-27
Web
Not rated
Path Traversal Vulnerability in Lila Project
HackerOneLichess2025-06-09
Web
High
Path Traversal Vulnerability found on IBM Cloud
HackerOneIBM2025-05-07
Web, Cloud
Critical
cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party
HackerOnePortSwigger Web Security2025-03-13$200 bounty
Windows
Low
Path traversal by drive name in Windows environment
HackerOneNode.js2025-01-27
Windows
Medium
Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10
HackerOneTrellix2025-01-12
Web
Critical
Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/`
HackerOneU.S. Dept Of Defense2024-10-25
Web
High
Path traversal in AcitveStorage, and lead RCE
HackerOneRuby on Rails2024-10-08
Web
High
Client-Side Path Traversal on LINE Developers Console
HackerOneLY Corporation2024-09-26
Web
Medium
Directory Traversal, SQL Injection and Server-Side Request Forgery
Researcher blogSage2024-09-10
Web
Not rated
IIS welcome page to source code review to LFI!
Medium2024-09-01
Web, Source Code
Not rated
The Hunt for XXE to LFI: How I Uncovered CVE-2019–9670 in a Bug Bounty Program
InfoSec Write-ups2024-08-31
Web
Not rated
CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]
HackerOneMTN Group2024-08-30
Web
Critical
Analysis of CVE-2024-43044 — From file read to RCE in Jenkins through agents
Researcher blogJenkins2024-08-29
Web
Not rated
$15k RCE Through Monitoring Debug Mode
Medium2024-08-28$15,000 bounty
Web
Not rated
3CX Phone System Local Privilege Escalation Vulnerability
Researcher blog3CX2024-08-28
Web
Not rated
Traccar 5 Remote Code Execution Vulnerabilities
Researcher blogTraccar2024-08-23
Web, Source Code
Not rated
Front-End Frameworks: When Bypassing Built-in Sanitization Might Backfire
Researcher blogFirefly III2024-08-13
Web, Source Code
Not rated
Oracle Retail Xstore Suite: Pre-authenticated Path Traversal
Researcher blogOracle2024-07-29
Web, Source Code
Not rated
Path Traversal and Code Execution in CSLA.NET (CVE-2024-28698)
Researcher blogCSLA.NET2024-07-25
Web, Source Code
Not rated
Studying 0days: How we hacked Anki, the world's most popular flashcard app
Researcher blogAnki2024-07-24
Web, Source Code
Not rated
[CVE-2018-0296] Cisco VPN path traversal on the https://███ (████████████████)
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
[CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
[CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (no hostname)
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
[CVE-2018-0296] Cisco VPN path traversal on the https://1████████ (https://████████.███.████████/)
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
Local File Inclusion in download.php
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
Firmware Security: Alcatel-Lucent ALE-DeskPhone
Researcher blogAlcatel-Lucent2024-07-12
Binary
Not rated
Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)
HackerOneBasecamp2024-07-09
Android
Medium
CVE-2024-29511 – Abusing Ghostscript’s OCR device
Researcher blogGhostscript2024-07-09
Web, Source Code
Not rated
Securing Developer Tools: Unpatched Code Vulnerabilities in Gogs (2/2)
Researcher blogGogs2024-07-09
Web, Source Code
Not rated
Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough
Researcher blogPyTorch, AWS, Google2024-07-08
Web, Cloud, AI
Not rated
WhatsUp Gold Pre-Auth RCE WriteDataFile Primitive (CVE-2024-4883)
Researcher blogProgress (WhatsUp Gold)2024-07-08
Web, Source Code
Not rated
WhatsUp Gold Pre-Auth RCE GetFileWithoutZip Primitive (CVE-2024-4885)
Researcher blogProgress (WhatsUp Gold)2024-07-08
Web, Source Code
Not rated
Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF
Researcher blog2024-07-02
Web
Not rated
From Limited file read to full access on Jenkins (CVE-2024-23897)
Researcher blog2024-07-02
Web
Not rated
CVE-2024-27292: docAssembling exploits for RCE
Researcher blogDocassemble2024-07-01
Web
Not rated
Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)
HackerOneMercadoLibre2024-06-28
Android
High
Exploiting Steam: Usual and Unusual Ways in the CEF Framework
Researcher blogValve (Steam), Google (Chromium)2024-06-27
Web
Not rated
17 vulnerabilities in Sharp Multi-Function Printers
GitHubSharp, Toshiba2024-06-27
API, Binary
Not rated
Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations
Researcher blogOllama2024-06-24
Web, AI
Not rated
Zip Slip meets Artifactory: A Bug Bounty Story
Researcher blogJFrog (Artifactory)2024-06-23$5,000 bounty
Web, Source Code
Not rated
From a GLPI patch bypass to RCE
Researcher blogGLPI2024-06-20
Web, Source Code
Not rated
[CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (████.███.mil)
HackerOneU.S. Dept Of Defense2024-06-18
Web
Medium
[CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (█████████.mil)
HackerOneU.S. Dept Of Defense2024-06-18
Web
Medium
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)
HackerOneU.S. Dept Of Defense2024-06-18
Web
High
[CVE-2018-0296] Cisco VPN path traversal on the https://██████████
HackerOneU.S. Dept Of Defense2024-06-18
Web
Medium
Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages
Researcher blogMailcow2024-06-17
Web, Source Code
Not rated
Path traversal by monkey-patching Buffer internals
HackerOneInternet Bug Bounty2024-05-29$2,430 bounty
Web
High
Non-authenticated path traversal leading to arbitrary file read
HackerOneExpressionEngine2024-05-28
Web
High
Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)
Researcher blogZscaler2024-05-27
Windows
Not rated
Bypassing WAFs to Exploit CSPT Using Encoding Levels
Researcher blog2024-05-10
Web
Not rated
Devfile file write vulnerability in GitLab
Researcher blogGitLab2024-05-03
Web
Not rated
Dangerous Import: SourceForge Patches Critical Code Vulnerability
Researcher blogSourceForge, Apache Allura2024-04-16
Web, Source Code
Not rated
[portswigger.net] Path Traversal al /cms/audioitems
HackerOnePortSwigger Web Security2024-04-04
Web
High
From Discovery to Disclosure: ReCrystallize Server Vulnerabilities
Researcher blogReCrystallize Software2024-03-22
Web
Not rated
Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices
Researcher blogErxes2024-03-21
Web, API, Source Code
Not rated
Broken access control in GoAnywhere Admin portal
Researcher blogFortra (GoAnywhere)2024-03-18
Web, Source Code
Not rated
CVE-2022-21371: Oracle WebLogic Server Local File Inclusion
HackerOneMars2024-03-04
Web
High
Arbitrary file read from Cloudflare Pages build environment
HackerOneCloudflare Public Bug Bounty2024-02-23
Web, Cloud
Medium
Hacking the Dutch Government
MediumDutch Government2024-02-17
Web
Not rated
Path traversal by monkey-patching Buffer internals
HackerOneNode.js2024-02-15
Web
High
Multiple permission model bypasses due to improper path traversal sequence sanitization
HackerOneNode.js2024-02-15
Web
High
Exploiting Empire C2 Framework
Researcher blogBC Security (Empire)2024-02-14
Web
Not rated
Form Tools Remote Code Execution: We Need To Talk About PHP
Researcher blog2024-02-08
Web, Source Code
Not rated
Null Byte on Steroids
Medium2024-02-06
Web
Not rated
ChatGPT Account Takeover - Wildcard Web Cache Deception
GitHubOpenAI (ChatGPT)2024-02-04$6,500 bounty
Web, AI
Not rated
Jumpserver Preauth RCE Exploit Chain
Researcher blogJumpServer2024-01-31
Web, Source Code
Not rated
Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins (CVE-2024-23897 & CVE-2024-23898)
Researcher blogJenkins2024-01-25
Web, Source Code
Not rated
CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive
Researcher blogFortra (GoAnywhere)2024-01-23
Web, Source Code
Not rated
Path traversal through path stored in Uint8Array in Node.js 20
HackerOneInternet Bug Bounty2024-01-20$3,495 bounty
Web
High
High Signal Detection and Exploitation of Ivanti's Pulse Connect Secure Auth Bypass & RCE (CVE-2023-46805 & CVE-2024-21887)
Researcher blogIvanti2024-01-19
Web, Source Code
Not rated
I found 2 Zero-Days in popular Linux distros that includes Mint, Kali, Parrot
MediumLinux Mint (Xreader), MATE Desktop (Atril)2024-01-17
Linux
Not rated
Multiple vulnerabilities in Ivanti Connect Secure
Researcher blogIvanti2024-01-17
Web, Source Code
Not rated
Writeup for CVE-2023-39143: PaperCut WebDAV Vulnerability
Researcher blogPaperCut2024-01-12
Web, Source Code
Not rated
Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360
Researcher blogAdobe (ColdFusion)2024-01-10
Web, Source Code
Not rated
The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”
Medium2024-01-01
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.