Security vulnerabilities and automated fixes for validation issues
1 post found
A proxy endpoint in the web server accepted file uploads via multipart form data and forwarded them directly to downstream AI services without validating file type, content, extension, or size. An attacker could upload executables, scripts, or polyglot files that would propagate to internal services. The fix adds strict MIME type and extension checks, plus a per-file size limit.