Description (CNA)
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Anil-matcha / Open-Generative-AI | affected 1.0.0; affected 1.0.1; affected 1.0.2; affected 1.0.3; affected 1.0.4; affected 1.0.5; affected 1.0.6; affected 1.0.7; affected 1.0.8; affected 1.0.9; affected 1.0.10; affected 1.0.11; affected 2.0 |
CWE
CWE-434, CWE-284
References
- https://vuldb.com/vuln/403185
- https://vuldb.com/vuln/403185/cti
- https://vuldb.com/cve/CVE-2026-90603
- https://vuldb.com/submit/914005
- https://github.com/Anil-matcha/Open-Generative-AI/issues/310
- https://github.com/Anil-matcha/Open-Generative-AI/commit/f013270957f75e439eaf97eb2a93decb32a4543e
- https://github.com/Anil-matcha/Open-Generative-AI/
ADP enrichment
No English description supplied.
No references supplied.