CVE-2026-90603

Received Received - Intake

Unrestricted File Upload in Anil-matcha Open-Generative-AI

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90603

EUVD

EUVD-2026-77138

Affected Vendors & Products

Vendor	Product	Version / Range
anil-matcha	open-generative-ai	to 1.0.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is in Anil-matcha Open-Generative-AI versions up to 1.0.11 and 2.0.0. It involves the /api/upload-binary endpoint where manipulation of the x-proxy-target-url argument allows unrestricted file uploads. This could let attackers remotely upload malicious files to the server.

Impact Analysis

Attackers could exploit this to upload malicious files, potentially leading to remote code execution, data breaches, or system compromise. Unrestricted uploads may also allow malware distribution or unauthorized access to sensitive data.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance may result in legal penalties, fines, or reputational damage due to unauthorized access or data leaks.

Mitigation Strategies

Apply the patch with commit ID f013270957f75e439eaf97eb2a93decb32a4543e to resolve the unrestricted upload vulnerability in Anil-matcha Open-Generative-AI versions up to 1.0.11/2.0.0.

Hi! I’m here to help you understand CVE-2026-90603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70