↓ Skip to main content
An exterior steel staircase climbing flight after flight up the flank of a large concrete industrial building.
Photo by Georgi Kulijanyan on Unsplash
  1. Archive/

Path Traversal on map.prezi.com ($1,000)

·1 min
Path traversal Information disclosure Coordinated disclosure Vendor response
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

Short story: I discovered a path traversal issue on one of Prezi’s domains, map.prezi.com.

Proof of concept
#

Proof-of-concept path traversal request against Prezi’s map.prezi.com host shown in the browser

Disclosure
#

Timeline: mail received 05/18/2014 21:01:00 — fixed 05/20/2014

The reply from Prezi’s security team:

Hi Patrik,

Thanks again for your submission, you were the first to report this issue and we deployed our fix, therefore you are eligible for a $1000 reward. Congrats!

We would like to ask for the following details for the payment: (bank details request omitted)

Thanks and congrats again!

Attila

Hats off to the great Prezi Security Team!

Related