VULNpocalypse

CVE-2026-90603: Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

Description quoted from the CVE record (assigned by VulDB, published 2026-09-13).

Weakness: Unrestricted Upload; Improper Access Controls

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality low, integrity low, availability low. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-77138, GHSA-xxxm-jwv4-xmv7

VEDAS cluster: VEDAS:DERBYDAISY

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

2 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.005
low predicted chance of attack
VEDAS
0.986
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
Anil-matcha Open-Generative-AIversion 1.0.0
version 1.0.1
version 1.0.2
version 1.0.3
version 1.0.4
version 1.0.5
version 1.0.6
version 1.0.7
and 5 more ranges		Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

How to detect it

Nuclei template (active check)

Open-Generative-AI - Unauthenticated S3 Upload Proxy

Anil-matcha Open-Generative-AI through 1.0.11/2.0.0 exposes POST /api/upload-binary (an S3 upload proxy) with no authentication. The handler reads the attacker-supplied x-proxy-target-url form field and forwards the uploaded file to it, enabling unrestricted upload and server-side request forgery. The fix adds an API key gate (401 “Missing API key”) before the target is read. This template sends an unauthenticated multipart request without the target field; a vulnerable host skips the auth gate and reaches the target validation (HTTP 400 “Missing proxy target URL”), whereas a patched host rejects it with 401 first.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (POST /api/upload-binary); it decides using status, word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-90603.yaml
Show the template (50 lines)
yaml
id: CVE-2026-90603

info:
  name: "Open-Generative-AI - Unauthenticated S3 Upload Proxy"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Anil-matcha Open-Generative-AI through 1.0.11/2.0.0 exposes POST /api/upload-binary (an S3 upload proxy)
    with no authentication. The handler reads the attacker-supplied x-proxy-target-url form field and forwards
    the uploaded file to it, enabling unrestricted upload and server-side request forgery. The fix adds an API
    key gate (401 "Missing API key") before the target is read. This template sends an unauthenticated
    multipart request without the target field; a vulnerable host skips the auth gate and reaches the target
    validation (HTTP 400 "Missing proxy target URL"), whereas a patched host rejects it with 401 first.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-90603&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=open-generative-ai&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 9.4
    cve-id: CVE-2026-90603
    cwe-id: CWE-434
  metadata:
    verified: false
  tags: cve,cve2026,open-generative-ai,upload,ssrf,intrusive

variables:
  boundary: "{{rand_text_alphanumeric(18)}}"

http:
  - raw:
      - |
        POST /api/upload-binary HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary={{boundary}}

        --{{boundary}}
        Content-Disposition: form-data; name="probe"

        vedas
        --{{boundary}}--

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 400
      - type: word
        part: body
        words:
          - 'proxy target URL'

CVE-2026-90603.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-90603 Open-Generative-AI - Unauthenticated Upload Proxy SSRF. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-90603 Open-Generative-AI - Unauthenticated Upload Proxy SSRF"; flow:established,to_server; http.uri; content:"/api/upload-binary"; fast_pattern; http.request_body; content:"x-proxy-target-url"; classtype:web-application-attack; reference:cve,CVE-2026-90603; reference:url,https://www.exploit.observer/?keyword=CVE-2026-90603&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=open-generative-ai&match=exact; sid:1082003; rev:1;)

CVE-2026-90603.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.