CVE-2026-59820: LiteLLM Path Traversal in Skill Upload – MEDIUM Severity

Technical summary

The vulnerability exists in LiteLLM's skill archive extraction logic prior to version 1.83.7-stable. The code fails to properly canonicalize and validate file paths extracted from user-supplied ZIP archives before writing them to disk. An attacker exploiting this flaw can use path traversal sequences (e.g., ../../) in ZIP entry names to escape the intended extraction directory. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and requires the attacker to possess API credentials with routes that include /v1/skills, anthropic_routes, or llm_api_routes. The CVSS 3.1 score of 6.5 (Medium) reflects the need for authenticated access and the integrity impact without confidentiality or availability loss in the base case.

Business impact

Organizations running LiteLLM as a central AI gateway face risk of configuration or application tampering. A malicious insider or compromised service account could inject unauthorized code or modify critical configuration files, leading to persistent compromise of downstream LLM integrations. This is particularly concerning if LiteLLM runs with elevated privileges or shares a filesystem with other sensitive services. The attack does not directly exfiltrate data but enables further compromise and could disrupt service availability indirectly through file system saturation or corruption.

Affected systems

LiteLLM versions prior to 1.83.7-stable are affected. Any deployment using the skill upload feature (accessible via /v1/skills, anthropic_routes, or llm_api_routes endpoints) is at risk. The vulnerability requires API authentication, so only users or services with valid credentials and appropriate route permissions can exploit it. Deployments that do not use the skill upload feature or restrict access to those endpoints are less critical, though we recommend updating regardless.

Exploitability

Exploitation requires two conditions: (1) valid API credentials to LiteLLM with routes that permit skill uploads, and (2) ability to craft and upload a ZIP archive with path traversal entries. The attack is straightforward once these prerequisites are met—no complex bypass techniques are needed. The vulnerability is likely exploitable by authenticated users without special network conditions (CVSS Access Vector: Network, Attack Complexity: Low). The primary barrier is authentication; this is not an unauthenticated remote code execution flaw. Internal threats, compromised service accounts, and overly permissive API key configurations raise practical risk.

Remediation

Upgrade LiteLLM to version 1.83.7-stable or later. This version includes fixes to validate and sanitize file paths during ZIP extraction, preventing traversal outside the intended staging directory. Before upgrading, audit which users or services have API keys with permissions to /v1/skills or related routes; consider restricting those permissions to only necessary consumers. Review access logs for any suspicious skill upload activity prior to patching.

Patch guidance

Update LiteLLM to version 1.83.7-stable as soon as feasible. This is a targeted patch addressing path traversal in the skill upload mechanism. Standard deployment procedures (pull latest image, update package manager, or build from source) apply depending on your LiteLLM installation method. Test in a staging environment if possible, though this vulnerability fix is low-risk and unlikely to cause compatibility issues. After patching, verify that skill upload functionality still works as expected in your use case.

Detection guidance

Monitor API logs for skill upload requests (POST /v1/skills or equivalent) originating from unexpected users or service accounts. Look for ZIP archive uploads with suspicious paynames containing ../ or other path traversal sequences. File system integrity monitoring on the LiteLLM host can detect unexpected file creation or modification outside normal skill directories—flag any writes to system directories, configuration paths, or other sensitive locations coinciding with skill uploads. Review LiteLLM's audit or request logs (if enabled) for patterns of malicious uploads before version 1.83.7 was deployed.

Why prioritize this

Although this is a MEDIUM severity flaw requiring authentication, it strikes at a core responsibility of an AI gateway: secure processing of user-supplied content. In environments where LiteLLM handles multi-tenant API access or shares infrastructure with other services, a successful exploit could compromise the gateway itself and any services depending on it. The integrity impact combined with the trend toward LiteLLM adoption in enterprise AI pipelines warrants prompt patching. Organizations should prioritize this within their standard patch cycle (2–4 weeks is reasonable), particularly if they allow external or contractor API access or run LiteLLM with broad file system permissions.

Risk score, explained

CVSS 3.1 score of 6.5 reflects the combination of network-accessible attack vector, low attack complexity, and requirement for authenticated access (thus a privileged context). The score emphasizes integrity impact (an attacker can modify files) without confidentiality or availability loss in the base scenario. The rating lands in MEDIUM territory because exploitation is gated by authentication and does not directly leak sensitive data or crash the service. However, the impact can be severe in practice depending on what files are overwritten or injected, warranting careful assessment in your specific threat model.

Frequently asked questions