CVE-2024-4888CWE-862

Arbitrary File Deletion in BerriAI/litellm

Medium · published June 6, 2024

CVSS v3.0
6.5
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-06-06T18:31Z
EPSS history
Timeline
  • 06 JUN 18:31Z
    Arbitrary File Deletion in BerriAI/litellm
    cvelistv5