CVE-2026-59820: LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

LiteLLM's Skills feature accepts a ZIP archive through POST /v1/skills. When a skill is processed for execution, the proxy extracts the archive and stages its files. Entry names were not checked, so an entry such as ../../x or an absolute path was written outside the intended extraction and staging directory (CWE-22, path traversal).

The attacker needs a valid LiteLLM identity with access to LLM API routes. That means a user, or a key whose allowed_routes includes /v1/skills, anthropic_routes or llm_api_routes. They do not need admin rights. The CVSS 4.0 vector rates integrity and availability impact as high and lists an attack requirement.

The result is arbitrary file write on the proxy host. The advisory says this may lead to code execution depending on deployment configuration and writable paths: for example, overwriting a Python file, a config file or a startup script that the proxy or its container later loads. A LiteLLM proxy holds provider API keys for many models, so a compromise reaches those keys too.

Affected: LiteLLM below 1.83.7. Instances are exposed when untrusted users or keys can reach /v1/skills, which includes any key that has the broad llm_api_routes or anthropic_routes route groups.

Check the installed version:

pip show litellm

For Docker deployments, check the image tag.

Upgrade to LiteLLM 1.83.7-stable or later. For pip installs, run pip install --upgrade litellm, then confirm with pip show litellm. The fix normalizes each archive entry path and skips entries that begin with .. or are absolute. It also checks that the resolved staging path stays under the temp directory.

If you cannot upgrade yet, the advisory gives two workarounds:

• Block POST /v1/skills at your reverse proxy or API gateway.
• Restrict Skills API access to trusted users only.

Look in the proxy's request logs for POST /v1/skills from keys that have no reason to upload skills. Check the host for files with recent timestamps outside the skills staging directory, especially Python sources, config files, shell profiles and startup scripts. After the fix, rejected entries are logged and skipped, so log lines about skipped skill archive paths on a patched proxy point to attempts. Review any skill archives you still hold for entries that start with .. or /.

Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

Patches

The issue is fixed in 1.83.7-stable.

LiteLLM recommens upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

1. Block POST /v1/skills at your reverse proxy or API gateway.
2. Restrict Skills API access to trusted users only.