- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 14
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,500 |
| Medium |
|
$1,000 |
| Low |
|
$250 |
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 1 excluded.
Source code 4
- https://filezilla-project.org/download.php?type=server&show_all=1 Critical
- https://fzssh.filezilla-project.org/download.php Critical
- https://svn.filezilla-project.org/svn/FileZilla3/trunk/ Critical
- https://svn.filezilla-project.org/svn/libfilezilla/trunk Critical
Out of scope (1)
- https://svn.filezilla-project.org/svn/filezilla3/trunk/src/storj
Rules
What the policy asks of you, and the bug types it won't reward, quoted from FileZilla (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
We do not accept submissions created using an AI
-
Please provide detailed reports with reproducible steps demonstrating a plausible exploitation scenario
-
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
-
Simple steps to reproduce the vulnerability without requiring the reproducing party to use specialized tools
-
A proof-of-concept (PoC)
Not accepted
-
Denial of service
-
Spamming
-
Social engineering (including phishing) against anybody associated with the FileZilla project
-
Any physical attempts against the property of the FileZilla project and its members.
-
Exploits which rely on the assumption that the attacker already has access to the user account FileZilla is run under on the victims system.
-
"Layer 8" issues.
-
File names, their sizes and modification times
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2019-25683 | FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation. | Medium 6.9 | 5 Apr 2026 |
| CVE-2023-53959 | FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches. | High 8.5 | 19 Dec 2025 |
| CVE-2024-31497 | In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git se | Medium 5.9 | 15 Apr 2024 |
| CVE-2023-48795 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occ | Medium 5.9 | 18 Dec 2023 |
| CVE-2016-15003 | A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | Medium 6.3 | 18 Jul 2022 |
| CVE-2015-10003 | A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component. | Medium 4.3 | 17 Jul 2022 |
| CVE-2022-29620 | FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability | Medium 6.5 | 7 Jun 2022 |
| CVE-2019-5429 | Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory. | High 7.8 | 29 Apr 2019 |
| CVE-2014-0224 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability. | High 7.4 | 5 Jun 2014 |
| CVE-2014-0160 | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. | High 7.5 | 7 Apr 2014 |
| CVE-2009-0884 | Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets. | Medium 4.3 | 12 Mar 2009 |
| CVE-2006-6565 | FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command. | Medium 4.0 | 15 Dec 2006 |
| CVE-2005-0850 | FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, and others. | Medium 5.0 | 2 May 2005 |
| CVE-2005-0851 | FileZilla FTP server before 0.9.6, when using MODE Z (zlib compression), allows remote attackers to cause a denial of service (infinite loop) via certain file uploads or directory listings. | Medium 5.0 | 2 May 2005 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Introduction
This bounty program is for the FileZilla Client, FileZilla Server and the libfilezilla library
Disclosure Policy
- Follow HackerOne's disclosure guidelines.
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Please provide detailed reports with reproducible steps demonstrating a plausible exploitation scenario, if the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- The project maintainers have final decision on which issues constitute security vulnerabilities.
Exclusions
Beware: We do not accept submissions created using an AI
While researching, we'd like to ask you to refrain from:
- Denial of service
- Spamming
- Social engineering (including phishing) against anybody associated with the FileZilla project
- Any physical attempts against the property of the FileZilla project and its members.
Scope
The bug bounty program will test only:
- The fully free open source version of the FileZilla Client as found on https://filezilla-project.org/download.php?type=client&show_all=1 and the source code repository described on https://filezilla-project.org/sourcecode.php. Other versions of FileZilla are not in the scope of this bounty program.
- The fully free open source version of the FileZilla Server as found on https://filezilla-project.org/download.php?type=server&show_all=1
- libfilezilla as available from https://lib.filezilla-project.org/download.php
All reported bugs must have a security impact. If you encounter ordinary bugs without security impact, please report them on https://trac.filezilla-project.org/
Out of Scope
- Outdated versions of the software
- Services running on the filezilla-project.org and filezillapro.com domains and their subdomains
- Exploits which rely on the assumption that the attacker already has access to the user account FileZilla is run under on the victims system.
- "Layer 8" issues. Always assume the user is making informed decisions if he is given the information to do so.
The following components are also explicitly not in the scope:
- The src/storj sub-directory of FileZilla Client and the libstorj dependency
- The src/putty sub-directory of FileZilla Client contains a modified code from PuTTY. Issues inherited from PuTTY are not in scope. Note: Issues in the modifications specific to FileZilla still are in scope.
Submission guidelines
While FileZilla products are cross-platform, vulnerabilities are to be evaluated given contemporary computer architectures.
Submissions must include either:
- We do not accept submissions created using an AI
- A detailed explanation explaining the vulnerability based on the source code
- Simple steps to reproduce the vulnerability without requiring the reproducing party to use specialized tools
- A proof-of-concept (PoC)
FileZilla Client technical overview
Building FileZilla
FileZilla uses the GNU autotools as build system.
It, as well as almost all its dependencies, can be built using the familiar configure && make && make install trinity.
The following two guides have recently been updated and can be used to build FileZilla:
- Debian and derived: https://wiki.filezilla-project.org/Compiling_FileZilla_3_and_Getting_Dependencies_on_Linux
- Windows: https://wiki.filezilla-project.org/Cross_Compiling_FileZilla_3_for_Windows_under_Ubuntu_or_Debian_GNU/Linux
Dependencies
FileZilla Client directly depends on the following libraries:
- libfilezilla: base library for many things such as networking, file i/o, string utilities and the main event system
- wxWidgets: GUI framework
- GnuTLS (via libfilezilla): TLS
- Nettle (via libfilezilla): Various cryptographic functions used e.g. for the master password functionality
- pugixml: DOM-style XML parser. XML is used to store settings
Architecture
FileZilla is organized in different components. The most important components are, identified by subdirectory:
src/engine: The protocol implementationssrc/engine/ftp: FTP specific functionalitysrc/engine/sftp: SFTP specific functionality, wraps around fzsftpsrc/engine/http: Everything specific to HTTP functionalitysrc/interface: The user interface and controlling logic such as the transfer queuesrc/putty: Source for fzsftp, a heavily modified version of PuTTY's psftpsrc/fzshellext: The Windows shell extension to facilitate Drag&drop from Explorer into FileZilla.
Interesting places
Due to their importance or complexity, we think these parts of the code warrant a closer look:
FileZilla:
src/engine/directorylistingparser.cpp: The directory listing parser insrc/interface/updater.cpp: The update mechanismsrc/engine/http/request.cpp: The HTTP state machine capable of request pipelining
libfilezilla
tls_layer_impl::verify_certificateinlib/tls_layer_impl.cpp: Certificate verificationlib/encryption.cpp: The asymmetric encryption scheme used for the master password functionality
FileZilla Server technical overview
Building FileZilla Server
Similar to building FileZilla Client. If you are able to build the client, you are able to build the server.
Dependencies
FileZilla Serverdirectly depends on the following libraries:
- libfilezilla: base library for many things such as networking, file i/o, string utilities and the main event system
- wxWidgets: GUI framework
- GnuTLS (via libfilezilla): TLS
- Nettle (via libfilezilla): Various cryptographic functions used
- pugixml: DOM-style XML parser. XML is used to store settings
Architecture
FileZilla Server is organized in different components. It comes with in the form of two programs: The FTP server service itself, and a separate administration user interface.
The most important components are, identified by subdirectory:
src/filezilla,src/server: The server functionality itself.src/gui: The administration user interface
Rewards
Our rewards are based on the severity of a vulnerability. HackerOne uses CVSS 3.0 (Common Vulnerability Scoring Standard) to calculate severity.
Specific to FileZilla and libfilezilla
| SEVERITY | CVSS SCORE | REWARD |
|---|---|---|
| critical | 9.0 - 10.0 | $5000 |
| High | 7.0 - 8.9 | $2500 |
| Medium | 4.0 - 6.9 | $1000 |
| Low | 0.1 - 3.9 | $250 |
Specific to FileZilla FileZilla Server
| SEVERITY | CVSS SCORE | REWARD |
|---|---|---|
| critical | 9.0 - 10.0 | $2000 |
| High | 7.0 - 8.9 | $1000 |
| Medium | 4.0 - 6.9 | $500 |
| Low | 0.1 - 3.9 | $250 |
Examples for vulnerabilities
Critical severity bugs
- Remote Code Execution over an unauthenticated channel
High severity bugs
- Code Execution over an authenticated channel
- Information leaks of private data such as file contents
Medium severity bugs
- Remotely triggered crashes
- Remotely triggered infinite loops
Low severity bugs
- Memory leaks
- Crashes as result of user action
- User-initiated infinite loops
No reward for leak of public information:
- File names, their sizes and modification times
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If you have any questions or concerns on this challenge, please contact [email protected].
Thank you for helping keep FileZilla and our users safe!