CVE-2024-4888: Litellm Path Traversal Vulnerability

CVE-2024-4888 Overview

CVE-2024-4888 is an arbitrary file deletion vulnerability in BerriAI's litellm, an open-source LLM proxy and gateway. The flaw resides in the /audio/transcriptions endpoint, which passes an attacker-controlled filename directly into os.remove(file.filename) without authorization checks or path validation. An authenticated attacker can submit a crafted request that deletes any file readable by the litellm process, including SSH keys, SQLite databases, and configuration files. The issue is tracked as a missing authorization defect [CWE-862].

Critical Impact
An attacker with low-privilege API access can remotely delete arbitrary files on the litellm host, causing service disruption, loss of persisted data, and potential compromise of downstream systems that trust the deleted artifacts.

Affected Products

BerriAI litellm (latest version at time of disclosure)
Deployments exposing the /audio/transcriptions endpoint
Self-hosted litellm proxy servers with authenticated user access

Discovery Timeline

2024-06-06 - CVE-2024-4888 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4888

Vulnerability Analysis

The /audio/transcriptions endpoint in litellm accepts a multipart upload and, after processing, deletes the uploaded artifact using os.remove(file.filename). The file.filename value is taken from the request without sanitization or path confinement. An attacker can submit a request whose filename attribute contains an absolute or relative path pointing to a sensitive file outside the intended upload directory. The Python runtime then removes the referenced file with the privileges of the litellm process.

Because the vulnerable code path does not verify that the caller owns the file or that the path resides within an approved directory, the flaw combines a path traversal primitive with a missing authorization check. Deleting SQLite databases, TLS keys, .env files, or SSH material can render the service inoperable and, in some deployments, aid follow-on compromise.

Root Cause

The root cause is improper input validation on a filename attribute supplied by the client, coupled with a missing authorization check on the delete operation [CWE-862]. The endpoint trusts the client-supplied path and performs a privileged file-system mutation with no allow-list, canonicalization, or ownership verification.

Attack Vector

Exploitation is performed over the network against the litellm HTTP API. The attacker requires low-privilege authenticated access to reach the endpoint. No user interaction is required. The attacker crafts a multipart request to /audio/transcriptions whose file part references an arbitrary absolute path such as /etc/ssl/private/server.key or the litellm SQLite database. When the handler completes, os.remove deletes the referenced path. Technical details are available in the Huntr Security Bounty report.

Detection Methods for CVE-2024-4888

Indicators of Compromise

Unexpected POST requests to /audio/transcriptions with filename fields containing path separators (/, .., or absolute paths).
Sudden absence of expected files such as SQLite databases, .env configuration files, or key material owned by the litellm service account.
Application errors or restart loops caused by missing configuration or credential files.

Detection Strategies

Enable verbose request logging on the litellm proxy and alert on multipart uploads whose filename metadata resolves outside the designated upload directory.
Deploy file integrity monitoring on directories containing keys, databases, and configuration files used by the litellm host.
Correlate HTTP access logs with unlink and open syscalls on the host to identify request-driven file deletions.

Monitoring Recommendations

Audit API key usage on litellm and alert on low-reputation keys issuing requests to file-handling endpoints.
Track process-level file deletions performed by the litellm service account and forward events to a central SIEM.
Baseline the set of files litellm normally writes and deletes, then alert on deviations that reference sensitive paths.

How to Mitigate CVE-2024-4888

Immediate Actions Required

Upgrade litellm to a version that patches the /audio/transcriptions handler and no longer passes untrusted paths to os.remove.
Restrict network exposure of the litellm proxy so only trusted clients and networks can reach the API.
Rotate any credentials, keys, or tokens stored on hosts that ran a vulnerable litellm build.

Patch Information

Refer to the Huntr Security Bounty report for the vendor fix reference. Users should upgrade to the fixed release of litellm published after June 6, 2024, and review release notes for the corrected file handling on the audio transcription endpoint.

Workarounds

Run the litellm process under a dedicated, unprivileged service account with a filesystem allow-list enforced through AppArmor, SELinux, or a container read-only root filesystem.
Place a reverse proxy in front of litellm that blocks or normalizes requests to /audio/transcriptions whose filename fields contain path separators or absolute paths.
Disable the /audio/transcriptions endpoint through configuration or upstream routing until the patched version is deployed.

bash

# Nginx example: reject audio transcription requests until litellm is patched
location = /audio/transcriptions {
    return 403;
}