FileZilla bug bounty programs
filezilla-project.org Updated
FileZilla runs two public programs: a HackerOne bug bounty paying up to $5,000 (paused) and a HackerOne bug bounty (paused).
- Top reward
- Not published
- Programs
- 2
- 2 pay cash
- Targets in scope
- 5
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
FileZilla
HackerOne · Pays up to $5,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
FileZilla
HackerOne · Bug bounty |
$5,000 (highest) | $2,500 (highest) | $1,000 (highest) | $250 (highest) | $5,000 | Full | – | 4 hours average | Paused |
|
FileZilla (European Commission - DIGIT)
HackerOne · Bug bounty |
– | – | – | – | Not published | – | – | – | Paused |
-
- Critical
- $5,000 (highest)
- High
- $2,500 (highest)
- Medium
- $1,000 (highest)
- Low
- $250 (highest)
- Safe harbor
- Full
- First response
- 4 hours average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
5 targets across all 2 programs, each listed once with the programs that cover it. 1 excluded.
-
https://svn.filezilla-project.org/svn/filezilla3/trunk/src/putty
Web Critical
Covered by FileZilla (European Commission - DIGIT)
-
https://filezilla-project.org/download.php?type=server&show_all=1
Source code Critical
Covered by FileZilla
-
https://svn.filezilla-project.org/svn/FileZilla3/trunk/
Source code Critical
Covered by FileZilla, FileZilla (European Commission - DIGIT)
-
https://svn.filezilla-project.org/svn/libfilezilla/trunk
Source code Critical
Covered by FileZilla (European Commission - DIGIT), FileZilla
No target matches. Try part of a host name, such as the company name.
Out of scope 1
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
https://svn.filezilla-project.org/svn/filezilla3/trunk/src/storj
FileZilla (European Commission - DIGIT) FileZilla
Recent changes
Reward and scope changes across every FileZilla program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in FileZilla products, from the NVD.
-
CVE-2019-25683 Medium
FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation.
-
CVE-2019-25683 Medium
FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation.
-
CVE-2023-53959 High
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.
-
CVE-2023-53959 High
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.
-
CVE-2024-31497 Medium
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git se
-
CVE-2024-31497 Medium
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git se
-
CVE-2023-48795 Medium
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occ
-
CVE-2023-48795 Medium
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occ
About this page
This page gathers every public program listed under filezilla-project.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.