The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*" ] }