LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
### Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted skill archive containing path traversal entries. When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths. ### Patches The issue is fixed in `1.83.7-stable`. LiteLLM recommens upgrading to `1.83.7-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Block `POST /v1/skills` at your reverse proxy or API gateway. 2. Restrict Skills API access to trusted users only.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59820US | medium6.5 | — | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file p… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/BerriAI/litellmPACKAGE
- https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196WEB
- https://github.com/BerriAI/litellm/pull/25475WEB
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stableWEB
- https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9qWEB
- https://github.com/advisories/GHSA-5jmr-gcrj-2c9qADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-59820ADVISORY
- https://pypi.org/project/litellmPACKAGE
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan