Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90603

Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90603

Published

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90603

Published

Open-Generative-AI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Anil-matcha",
                    "product": "Open-Generative-AI",
                    "versions": [
                        {
                            "version": "1.0.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.1",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.2",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.3",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.4",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.6",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.7",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.8",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.10",
                            "status": "affected"
                        },
                        {
                            "version": "1.0.11",
                            "status": "affected"
                        },
                        {
                            "version": "2.0",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:anil-matcha:open-generative-ai:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "S3 Upload"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON