Path Traversal in Gitea

GHSA-h3q4-vmw4-cpr5 · BIT-gitea-2021-29134 · CVE-2021-29134 · GO-2022-0353

Published Mar 16, 2022 · Modified Aug 21, 2024

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-29134
WEB https://github.com/go-gitea/gitea/pull/15125/files
PACKAGE https://github.com/go-gitea/gitea
WEB https://github.com/go-gitea/gitea/releases
WEB https://github.com/go-gitea/gitea/releases/tag/v1.13.6

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Path Traversal in Gitea

Description

References

More Go vulnerabilities

Start Securing