chore(proxy): contain UI_LOGO_PATH / LITELLM_FAVICON_URL on unauthenticated asset endpoints - #26815

Merged

yuneng-berri merged 12 commits into

BerriAI:litellm_internal_stagingfrom

stuxf:fix/get-image-lfi-ssrf

May 1, 2026

Commits on Apr 29, 2026

fix(proxy): contain UI_LOGO_PATH and LITELLM_FAVICON_URL to allowed asset roots

stuxf
and
claude
committed
0166992
fix(proxy): /get_logo_url no longer discloses local UI_LOGO_PATH

stuxf
and
claude
committed
9ef8572
fix(proxy): also accept LITELLM_ASSETS_PATH for /get_favicon local path

stuxf
and
claude
committed
4f751fd
fix(static-assets): unblock CI — pass headers explicitly + harden + update legacy tests

stuxf
and
claude
committed
55d393d
fix(static-assets): use async_safe_get; drop SVG; serve bytes inline on cache miss

stuxf
and
claude
committed
75d1a01
chore(static-assets): /simplify pass — top-level Response import + cleaner test fixture

stuxf
and
claude
committed
c112bdf
fix(static-assets): also wrap admin-only Vault token verification in async_safe_get

stuxf
and
claude
committed
89aa13f
fix(static-assets): ruff F811 — drop duplicate Response import

stuxf
and
claude
committed
14473ed

Commits on Apr 30, 2026