CVE-2026-90603 | Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0 S3 Upload /api/upload-binary x-proxy-target-url unrestricted upload (Issue 310)

A vulnerability described as critical has been identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload.

This vulnerability is traded as CVE-2026-90603. The attack may be launched remotely. There is no exploit available.

Applying a patch is advised to resolve this issue.VulDB Recent EntriesRead More