Browse / GitLab

GitLab

See its reports on the map

Attack surface: 785 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to GitLab

• Cross-site Scripting57
• Access Control53
• Information Disclosure32
• Code Execution18
• Server-Side Request Forgery18
• Misconfiguration16

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Arbitrary file read via the UploadsRewriter when moving and issuePath Traversal · critical
   $20,0001,503 votes
2. Account Takeover via Password Reset without user interactionsImproper Access Control - Generic · critical
   $35,000989 votes
3. Git flag injection - local file overwrite to remote code executionCommand Injection - Generic · critical
   $12,000777 votes
4. Exfiltrate and mutate repository and project data through injected templated serviceImproper Access Control - Generic · critical
   $11,000762 votes
5. Stored XSS in Wiki pagesCross-site Scripting (XSS) - Stored · high
   633 votes
6. Local files could be overwritten in GitLab, leading to remote command executionCommand Injection - Generic · critical
   $12,000542 votes
7. RCE when removing metadata with ExifToolCode Injection · critical
   $20,000508 votes
8. Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsPrivilege Escalation · critical
   $12,000457 votes
9. RCE via unsafe inline Kramdown options when rendering certain Wiki pagesCode Injection · critical
   $20,000427 votes
10. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readInformation Disclosure · critical
    $10,000410 votes
11. Remote Command Execution via Github importCommand Injection - Generic · critical
    $33,510392 votes
12. RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Command Injection - Generic · critical
    $33,510387 votes
13. JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsInformation Disclosure · critical
    $12,000366 votes
14. Bypass of GitLab CI runner slash fix in YAML validationImproper Input Validation · critical
    363 votes
15. SSRF on project import via the remote_attachment_url on a NoteServer-Side Request Forgery (SSRF) · high
    $10,000359 votes
16. Attacker is able to access commit title and team member comments which are supposed to be privateImproper Access Control - Generic · high
    351 votes
17. Server Side Request Forgery mitigation bypassServer-Side Request Forgery (SSRF) · high
    350 votes
18. Arbitrary file read via the bulk imports UploadsPipelinePath Traversal · critical
    $29,000329 votes
19. Stored XSS in markdown via the DesignReferenceFilter Cross-site Scripting (XSS) - Stored · critical
    $16,000317 votes
20. An attacker can run pipeline jobs as arbitrary userBusiness Logic Errors · critical
    $12,000307 votes
21. Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comIncorrect Authorization · critical
    306 votes
22. Stored XSS via Kroki diagramCross-site Scripting (XSS) - Stored · high
    $13,950295 votes
23. Cross-site Scripting (XSS) - Stored in RDoc wiki pagesUI Redressing (Clickjacking) · high
    $3,500282 votes
24. RCE via github importOS Command Injection · critical
    271 votes
25. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high
    $3,000257 votes
26. Privilege escalation from any user (including external) to gitlab admin when admin impersonates youPrivilege Escalation · critical
    256 votes
27. Steal private objects of other projects via project importInsecure Direct Object Reference (IDOR) · critical
    $20,000254 votes
28. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainReliance on Untrusted Inputs in a Security Decision · medium
    249 votes
29. Unauthenticated blind SSRF in OAuth Jira authorization controllerServer-Side Request Forgery (SSRF) · high
    $4,000238 votes
30. Full Read SSRF on Gitlab's Internal GrafanaServer-Side Request Forgery (SSRF) · critical
    229 votes
31. Ability To Delete User(s) Account Without User InteractionMisconfiguration · high
    221 votes
32. Group search leaks private MRs, code, commitsImproper Access Control - Generic · high
    212 votes
33. Arbitrary file read during project importPath Traversal · critical
    $16,000194 votes
34. Stored-XSS with CSP-bypass via labels' colorCross-site Scripting (XSS) - Stored · high
    169 votes
35. Git flag injection leading to file overwrite and potential remote code executionCommand Injection - Generic · critical
    $3,500169 votes
36. Snippet JS template allows attacker to read a user's private snippetsInformation Disclosure · low
    $300165 votes
37. Stored XSS in Notes (with CSP bypass for gitlab.com)Cross-site Scripting (XSS) - Stored · high
    161 votes
38. Importing GitLab project archives can replace uploads of other usersInsecure Direct Object Reference (IDOR) · high
    148 votes
39. information disclosure of secret_key_base via encoding charctersInformation Exposure Through an Error Message · high
    $3,500146 votes
40. DoS on the Issue page by exploiting Mermaid.Uncontrolled Resource Consumption · medium
    $3,000145 votes
41. Path traversal, to RCECommand Injection - Generic · high
    $12,000142 votes
42. Mint Oauth2 access token for targeted userImproper Authentication - Generic · high
    $5,580140 votes
43. Persistent XSS in Note objectsCross-site Scripting (XSS) - Stored · high
    $4,500139 votes
44. Send arbitrary PUT requests when user clicks on a linkCommand Injection - Generic · medium
    135 votes
45. Private objects exposed through project importInsecure Direct Object Reference (IDOR) · critical
    $20,000133 votes
46. Stored XSS in custom emojiCross-site Scripting (XSS) - Stored · high
    $3,000130 votes
47. Git flag injection - Search API with scope 'blobs' Command Injection - Generic · high
    $7,000130 votes
48. IDOR Exposes All Machine Learning ModelsInsecure Direct Object Reference (IDOR) · medium
    $1,160117 votes
49. Read files on application server, leads to RCEInformation Disclosure · critical
    114 votes
50. Able to view hackerone reports attachmentsInsecure Storage of Sensitive Information · critical
    103 votes
51. CSP-bypass XSS in project settings pageCross-site Scripting (XSS) - Generic · high
    100 votes
52. Group search with Elastic search enable leaks unrelated dataImproper Access Control - Generic · high
    100 votes
53. Account takeover due to insufficient URL validation on RelayState parameterCross-Site Request Forgery (CSRF) · medium
    $2,45099 votes
54. Bypass: Stored-XSS with CSP-bypass via scoped labels' colorCross-site Scripting (XSS) - Stored · high
    96 votes
55. XSS in request approvalsCross-site Scripting (XSS) - Stored · medium
    $3,00096 votes
56. New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsCross-site Scripting (XSS) - Stored · high
    $13,95093 votes
57. Unrestricted file upload leads to Stored XSSCross-site Scripting (XSS) - Stored · medium
    90 votes
58. RepositoryPipeline allows importing of local git reposImproper Access Control - Generic · medium
    $22,30089 votes
59. Stored XSS in "Create Groups"Cross-site Scripting (XSS) - Stored · high
    $2,50089 votes
60. CSRF on /api/graphql allows executing mutations through GET requestsCross-Site Request Forgery (CSRF) · high
    $3,37088 votes
61. Path traversal in Nuget Package RegistryPath Traversal · high
    $12,00088 votes
62. DoS attack via comment on IssueUncontrolled Resource Consumption · low
    $1,00084 votes
63. Cache poisoning Denial of Service affecting assets.gitlab-static.netUncontrolled Resource Consumption · high
    83 votes
64. XSS in ZenTao integration affecting self hosted instances without strict CSPCross-site Scripting (XSS) - Generic · high
    81 votes
65. Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"Cross-site Scripting (XSS) - Stored · high
    80 votes
66. Subdomain takeover in Gitlab pagesMisconfiguration · low
    79 votes
67. GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionOS Command Injection · high
    77 votes
68. Remove obsolete domain from handbook subdomainMisconfiguration · low
    72 votes
69. GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryServer-Side Request Forgery (SSRF) · high
    72 votes
70. SSRF in CI after first runServer-Side Request Forgery (SSRF) · medium
    72 votes
71. Stored-XSS injected in Wiki page via Banzai pipelineCross-site Scripting (XSS) - Stored · high
    71 votes
72. Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenPrivilege Escalation · medium
    66 votes
73. DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverUncontrolled Resource Consumption · medium
    $2,30064 votes
74. GraphQL query "namespace" leaks dataImproper Access Control - Generic · medium
    64 votes
75. HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressResource Injection · low
    $1,06061 votes
76. Ability to access all user authentication tokens, leads to RCEPrivilege Escalation · critical
    61 votes
77. [Admin Panel] CSRF to resume/pause runnerCross-Site Request Forgery (CSRF) · low
    60 votes
78. Stored-XSS on wiki pagesCross-site Scripting (XSS) - Stored · medium
    59 votes
79. Stored XSS via Mermaid Prototype Pollution vulnerabilityCross-site Scripting (XSS) - Stored · high
    $3,00058 votes
80. FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comServer-Side Request Forgery (SSRF) · high
    58 votes
81. Know whether private project name exists or not within a group using link commentsInformation Disclosure · low
    58 votes
82. Content injection in Jira issue title enabling sending arbitrary POST request as victimResource Injection · high
    55 votes
83. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high
    55 votes
84. EXIF metadata not stripped from JPG group logosInformation Disclosure · low
    $50055 votes
85. Arbitrary POST request as victim user from HTML injection in Jupyter notebooksResource Injection · high
    54 votes
86. Access to GitLab's Slack by abusing issue creation from e-mailImproper Authentication - Generic · critical
    54 votes
87. Stored XSS in merge request pagesCross-site Scripting (XSS) - Stored · high
    $3,50053 votes
88. All functions that allow users to specify color code are vulnerable to ReDoSUncontrolled Resource Consumption · low
    $1,00053 votes
89. Change project visibility to a restricted optionViolation of Secure Design Principles · medium
    $1,37051 votes
90. RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedOS Command Injection
    $3,00050 votes
91. Stored XSS on the job pageCross-site Scripting (XSS) - Stored · high
    $3,00050 votes
92. Stored XSS in markdown when redacting referencesCross-site Scripting (XSS) - Stored · high
    $5,00050 votes
93. Clientside resource Exhausting by exploiting gitlab math rendering Uncontrolled Resource Consumption · low
    50 votes
94. Command injection by overwriting authorized_keys file through GitLab importCommand Injection - Generic · critical
    $2,00050 votes
95. Improper access control for users with expired password, giving the user full access through API and GitImproper Access Control - Generic · medium
    49 votes
96. Guest users can create new test casesPrivilege Escalation · medium
    $65049 votes
97. XSS on Issue reference numbersCross-site Scripting (XSS) - DOM · medium
    49 votes
98. View the Starred Projects in a Private ProfileInsecure Direct Object Reference (IDOR) · low
    $50049 votes
99. Stored XSS via Mermaid Prototype Pollution vulnerabilityCross-site Scripting (XSS) - Stored · high
    $3,00048 votes
100. A deactivated user can access data through GraphQLImproper Access Control - Generic · medium
     47 votes