LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
MediumCVE-2026-59820 · Published Jul 22, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.83.7 | 1.83.7 |
Details and references
### Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted skill archive containing path traversal entries. When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths. ### Patches The issue is fixed in `1.83.7-stable`. LiteLLM recommens upgrading to `1.83.7-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Block `POST /v1/skills` at your reverse proxy or API gateway. 2. Restrict Skills API access to trusted users only.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-59820, PYSEC-2026-3477
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | LiteLLM: Local file read via request-supplied OIDC file references CVE-2026-59819Lowfixed in 1.83.10 | Low | 1.83.10 |
| Jul 22 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822Highfixed in 1.84.0 | High | 1.84.0 |
| Jul 22 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks CVE-2026-59821Lowfixed in 1.82.0 | Low | 1.82.0 |
| Jun 21 | BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader CVE-2026-12798Low6.3no fix yet | Low6.3 | No fix yet |
| Jun 21 | BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure CVE-2026-12799Low4.3no fix yet | Low4.3 | No fix yet |
| Jun 21 | BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints CVE-2026-12797Low6.3no fix yet | Low6.3 | No fix yet |