CVE-2026-90603
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e.
Risk Assessment
A remote attacker can upload arbitrary files to the server, potentially leading to malicious code execution, service takeover or data leakage.
Recommendation
Apply patch f013270957f75e439eaf97eb2a93decb32a4543e or update Open-Generative-AI to a version containing this fix; until then, restrict access to the /api/upload-binary endpoint.
Other vulnerabilities in Open-Generative-AI
Original NVD description (English source)
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS