Directory traversal

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...