CVE-2021-29134: Gitea

Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days.

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

Affected products

• Gitea Gitea: before 1.13.6 (fixed in 1.13.6)

Published 2022-03-15. Last modified 2026-06-17.