CVE-2026-90603
Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.
| CWE | CWE-434 CWE-284 |
| Vendor | anil-matcha |
| Product | open-generative-ai |
| Published | Sep 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for anil-matcha open-generative-ai
Be the first to know when new high vulnerabilities affecting anil-matcha open-generative-ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Anil-matcha / Open-Generative-AI
1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.0.10 1.0.11 2.0
References
vuldb.com: https://vuldb.com/vuln/403185 vuldb.com: https://vuldb.com/vuln/403185/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90603 vuldb.com: https://vuldb.com/submit/914005 github.com: https://github.com/Anil-matcha/Open-Generative-AI/issues/310 github.com: https://github.com/Anil-matcha/Open-Generative-AI/commit/f013270957f75e439eaf97eb2a93decb32a4543e github.com: https://github.com/Anil-matcha/Open-Generative-AI/
Credits
🔍 Practice (VulDB User)