Unrestricted Upload Vulnerability in Anil-matcha Open-Generative-AI
CVE-2026-90603

6.9MEDIUM

Key Information:

Vendor

Anil-matcha

Status
Open-generative-ai
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90603?

A vulnerability exists within the Anil-matcha Open-Generative-AI product that allows for unrestricted file upload through its S3 Upload component, specifically at the /api/upload-binary endpoint. This issue arises from insecure handling of the 'x-proxy-target-url' argument, which can enable remote attackers to upload malicious files without appropriate validation. The recommended fix involves applying a patch identified by the change ID f013270957f75e439eaf97eb2a93decb32a4543e.

Affected Version(s)

Open-Generative-AI 1.0.0

Open-Generative-AI 1.0.1

Open-Generative-AI 1.0.2

References

https://vuldb.com/vuln/403185
vdb-entrytechnical-description
https://vuldb.com/vuln/403185/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90603
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Practice (VulDB User)
.