The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
| Software | From | Fixed in |
|---|---|---|
| gitea / gitea | - | 1.13.6 |
code.gitea.io/gitea
|
- | 1.13.6 |