PT-2026-90987 · Anil Matcha+1 · Open-Generative-Ai
CVSS v2.0
7.5
عالية
| المتجه | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Anil-matcha Open-Generative-AI versions 1.0.11 and 2.0.0
Description
A remote attacker can achieve unrestricted upload by manipulating the
x-proxy-target-url argument within the S3 Upload component at the '/api/upload-binary' endpoint.Recommendations
Apply patch f013270957f75e439eaf97eb2a93decb32a4543e for version 1.0.11.
Apply patch f013270957f75e439eaf97eb2a93decb32a4543e for version 2.0.0.
استغلال
إصلاح
Improper Access Control
Unrestricted File Upload
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Open-Generative-Ai