Description

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T23:16:28.703Z",
  "pubdate": "2026-09-13T23:16:28.703Z",
  "executiveSummary": "A vulnerability has been identified in the S3 Upload component within Anil-matcha Open-Generative-AI, versions up to 1.0.11 and 2.0.0. This flaw involves an unrestricted file upload mechanism originating from improper handling of the x-proxy-target-url argument within the /api/upload-binary endpoint.\nThe vulnerability allows remote attackers to bypass security controls and perform unauthorized file uploads. By manipulating the x-proxy-target-url parameter, an attacker can influence the destination or nature of the binary upload process. The impact of such a vulnerability is critical, potentially leading to arbitrary file execution, remote code execution (RCE), or the hosting of malicious content on the infrastructure associated with the S3 Upload component.\nThis issue is exploitable remotely without requiring prior authentication in the context of the exposed endpoint. Organizations utilizing the affected versions of Anil-matcha Open-Generative-AI are at significant risk of system compromise and should prioritize remediation efforts to prevent malicious exploitation.",
  "technicalDetails": "The vulnerability resides within the /api/upload-binary endpoint of the S3 Upload component in Anil-matcha Open-Generative-AI. The root cause is an improper validation and sanitization mechanism for the x-proxy-target-url argument during the binary upload process. In the affected versions (up to 1.0.11/2.0.0), the application fails to restrict the target destination or the integrity of the uploaded data, effectively allowing an attacker to abuse the upload handler.\nThe exploitation flow begins with the attacker sending a crafted HTTP request to the /api/upload-binary endpoint. By injecting a malicious or unauthorized value into the x-proxy-target-url header or query parameter, the attacker instructs the backend component to redirect the binary data stream or target an unintended S3 bucket or internal endpoint. Because the application lacks sufficient verification of the proxy target, the backend processes the request as a legitimate upload operation, facilitating the transfer of arbitrary files.\nTechnically, the component likely uses the x-proxy-target-url argument to facilitate proxied uploads to S3 or a secondary storage layer. The failure to whitelist allowed target URLs or validate the destination structure allows for Server-Side Request Forgery (SSRF)-like behavior, combined with the capability to write files to arbitrary locations. If the application environment does not enforce strict content-type validation or directory traversal protections, an attacker could potentially overwrite critical application files or upload malicious scripts (e.g., webshells) that are subsequently executable by the web server.\nThe attack is remotely executable, meaning no local access is required to initiate the exploitation sequence. Post-exploitation impact includes unauthorized data modification, loss of confidentiality regarding stored assets, and potentially full system compromise if the attacker successfully uploads an executable payload to a web-accessible directory. The remediation for this vulnerability requires strict validation of the x-proxy-target-url input against a predefined, trusted whitelist of endpoints and ensuring that the underlying file-handling logic enforces secure, path-restricted storage practices."
}