Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Anil-matcha Open-Generative-AI allows remote file upload

CVE-2026-90603 · published 1 month ago
Summary

The Open-Generative-AI system (versions up to 1.0.11 and 2.0.0) lets anyone send a specially crafted request to the /api/upload-binary endpoint and store files on the server without permission. This could let attackers place malicious content on your system, potentially leading to further compromise. Install the provided update (patch f013270957f75e439eaf97eb2a93decb32a4543e) as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
anil-matcha open-generative-ai 1.0.0
Original advisory text
Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-434Unrestricted File Upload
Timeline
Published13 Sep 2026
Updated4 Nov 2026
First seen13 Sep 2026
Sources
CVE-2026-90603 · NVD
CVE-2026-90603 · MITRE
CVE-2026-90603 · OSV
Track software like this
Free during beta