{"data":{"id":"a43a0da3-56f2-4fec-9fcb-bb53168ccf08","title":"CVE-2024-4888: BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on…","summary":"BerriAI's litellm, in its latest version, contains an arbitrary file deletion flaw tracked as CVE-2024-4888. Improper input validation on the /audio/transcriptions endpoint lets an attacker send a crafted request containing a file path, and the server then removes that file through os.remove(file.filename) without authorization checks. Any user can therefore delete critical server files, such as SSH keys, SQLite databases, or configuration files.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-4888","publishedAt":"2024-06-06T23:16:03.397Z","cveId":"CVE-2024-4888","cweIds":["CWE-862","CWE-862"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["litellm@< 1.35.36 (fixed: 1.35.36)"],"affectedPackageNames":["litellm"],"affectedPackageRefs":["pypi:litellm"],"affectedVendors":[],"affectedVendorsRaw":["litellm"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BerriAI litellm arbitrary file deletion through /audio/transcriptions endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00619,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":["GHSA-3xr8-qfvj-9p9j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:45.494Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:45:48.485Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"litellm","fixedVersion":"1.35.36","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"tracked","status":"version_not_found","checkedAt":"2026-10-29T21:45:48.335Z"}]}}