VulnWatch VulnWatch
← Back to dashboard
Medium osv · GHSA-3xr8-qfvj-9p9j

Arbitrary file deletion in litellm

Published Jun 6, 2024 CVSS 4.0

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where os.remove(file.filename) is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.

Affected AI Products

litellm
Get the weekly digest. Every Monday: top AI security stories of the week. Free.