LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

TRUNG BÌNH 6.5CVE-2026-59820 · GHSA-5jmr-gcrj-2c9q · PYSEC-2026-3477 · Công bố 08/07/2026 · cập nhật 25/10/2026

Tóm tắt nhanh

CVE-2026-59820 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng litellm, litellm (litellm).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.59%, cao hơn 48.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.83.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
litellm PyPI	`< 1.83.7`	`1.83.7`
litellm litellm	`= 1.83.7< 1.83.7`	`1.83.7`

Mô tả

Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

Patches

The issue is fixed in 1.83.7-stable.

LiteLLM recommens upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

Block POST /v1/skills at your reverse proxy or API gateway.
Restrict Skills API access to trusted users only.

Mô tả của NVD

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.