6.5
Moyenne
CVE-2024-4888 BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on…
Description
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| berriai/litellm | Versions non publiées | |
| litellm | 1.34.41 | Pas de correctif indiqué |
Références
- huntr.com huntr.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de berriai/litellm
Les 15 CVE de berriai/litellm →
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
8.8
Élevée
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
Élevée
CVE-2025-0628
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
8.1
Élevée
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
Élevée