BerriAI/litellm · error · HTTPException

Invalid {field_name}: must be an http(s) URL with a host. Lo

Error message

Invalid {field_name}: must be an http(s) URL with a host. Local filesystem paths and non-http schemes are not allowed.

What it means

SSRF/path guard in _validate_public_image_url: the submitted UI branding URL failed urlparse checks — it is not a plain http/https URL with a host (e.g. '/etc/passwd', 'file://...', or a schemeless value). Because the URL is later served verbatim by the unauthenticated /get_image endpoint, local filesystem paths and non-http schemes are rejected.

Source

Thrown at litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py:1154

        **stored_values,
        **{field: _resolve_ui_theme_field(stored_values, field) for field in _UI_THEME_FIELD_ENV_VARS},
    }
    return result


def _validate_public_image_url(value: str | None, field_name: str) -> None:
    """
    Reject anything that isn't a plain http(s) URL with a host. This value is
    later served via the unauthenticated /get_image endpoint, so local paths
    like "/etc/passwd" or "file://..." must not be accepted.
    """
    if value is None:
        return
    if not isinstance(value, str) or not value.strip():
        return
    parsed: Final = urlparse(value.strip())
    if parsed.scheme not in ("http", "https") or not parsed.netloc:
        raise HTTPException(
            status_code=400,
            detail={
                "error": (
                    f"Invalid {field_name}: must be an http(s) URL with a host. "
                    "Local filesystem paths and non-http schemes are not allowed."
                )
            },
        )


@router.patch(
    "/update/ui_theme_settings",
    tags=["UI Theme Settings"],
    dependencies=[Depends(user_api_key_auth)],
)
async def update_ui_theme_settings(
    theme_config: UIThemeConfig,
    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Provide a valid http(s) URL with a host for the field; local paths and other schemes are rejected.

When it happens

Trigger: Thrown at litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py:1154 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/62d3b1740f9216e1. Report an issue: GitHub.