Executive brief
Open-Generative-AI is an open-source AI media generation platform that uses Amazon S3 for file storage. An unauthenticated attacker can bypass upload restrictions by manipulating the x-proxy-target-url parameter in the /api/upload-binary endpoint, allowing arbitrary files to be uploaded to S3 buckets. This could enable malware distribution, account compromise, or denial-of-service attacks.
Technical details
The vulnerability is an unrestricted file upload flaw in the S3 upload proxy component (endpoint /api/upload-binary). The x-proxy-target-url parameter is not properly validated, allowing an attacker to redirect uploads to arbitrary S3 locations without authentication. The attack is network-accessible and requires no prior authentication or user interaction. An attacker can upload malicious files directly to S3 storage, potentially leading to code execution if the uploaded files are served back to users. A patch (commit f013270957f75e439eaf97eb2a93decb32a4543e) has been published that adds proper authentication checks via Authorization headers and credential validation.
Affected products
- Anil-matcha Open-Generative-AI up to 1.0.11 and 2.0.0
Timeline
- 2026-09-13: disclosed
- 2026-08-04: patched: Patch commit f013270957f75e439eaf97eb2a93decb32a4543e