Most recent entries from all

CVE-2026-59820 — LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

2026-10-01T19:38:05.566623+00:00

Affected: BerriAI litellm

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

GHSA-5jmr-gcrj-2c9q — LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

2026-10-01T19:38:05.566919+00:00

Affected: PyPI: litellm

### Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

### Patches

The issue is fixed in `1.83.7-stable`.

LiteLLM recommens upgrading to `1.83.7-stable` or later.

### Workarounds

If upgrading is not immediately possible:

1. Block `POST /v1/skills` at your reverse proxy or API gateway. 2. Restrict Skills API access to trusted users only.

PYSEC-2026-3477 — LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

2026-10-01T19:38:05.566997+00:00