PT-2026-90987 · Anil Matcha+1 · Open-Generative-Ai

Practice

·

CVE-2026-90603

·

Published

2026-09-13

·

Updated

2026-09-13

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Anil-matcha Open-Generative-AI versions 1.0.11 and 2.0.0
Description A remote attacker can achieve unrestricted upload by manipulating the x-proxy-target-url argument within the S3 Upload component at the '/api/upload-binary' endpoint.
Recommendations Apply patch f013270957f75e439eaf97eb2a93decb32a4543e for version 1.0.11. Apply patch f013270957f75e439eaf97eb2a93decb32a4543e for version 2.0.0.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-284CWE-434

Related Identifiers

CVE-2026-90603

Affected Products

Open-Generative-Ai