LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact
LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.
When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.
Patches
The issue is fixed in 1.83.7-stable.
LiteLLM recommens upgrading to 1.83.7-stable or later.
Workarounds
If upgrading is not immediately possible:
- Block
POST /v1/skillsat your reverse proxy or API gateway. - Restrict Skills API access to trusted users only.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | litellm | < 1.83.7 | 1.83.7 |
Referencias
- https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9q
- https://nvd.nist.gov/vuln/detail/CVE-2026-59820
- https://github.com/BerriAI/litellm/pull/25475
- https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- https://pypi.org/project/litellm
- https://github.com/advisories/GHSA-5jmr-gcrj-2c9q
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
litellm- Publicada
- 22.07.2026
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-3477 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5jmr-gcrj-2c9q - CC BY 4.0
Historial de vulnerabilidades: litellm
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 42
- Primera → última
- 04.2024 09.2026
- Sin corrección
- 14
- Explotada en ataques
- 3
Distribución por gravedad
- Crítica 7
- Alta 17
- Media 8
- Baja 9
- Sin evaluar 1
Divulgaciones por año
- 2024: 8
- 2025: 6
- 2026: 28
-
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.