CVE-2026-59820: LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact
LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive containing path traversal entries.
When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.
Patches
The issue is fixed in 1.83.7-stable.
LiteLLM recommens upgrading to 1.83.7-stable or later.
Workarounds
If upgrading is not immediately possible:
1. Block POST /v1/skills at your reverse proxy or API gateway. 2. Restrict Skills API access to trusted users only.
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.7 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.83.7-stable - Configuration
Restrict Skills API access to trusted users only (so only trusted authenticated users/keys can access the /v1/skills and related route sets).
LiteLLM Skills API Access control for Skills API routes (e.g., /v1/skills, anthropic_routes, llm_api_routes) = trusted-only - Compensating control
Block POST /v1/skills at your reverse proxy or API gateway.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59820?
The severity of CVE-2026-59820 is medium with a CVSS score of 6.1.
How do I fix CVE-2026-59820?
To fix CVE-2026-59820, upgrade LiteLLM to version 1.83.7-stable or later.
What type of vulnerability is CVE-2026-59820?
CVE-2026-59820 is classified as a Path Traversal vulnerability.
Who is affected by CVE-2026-59820?
Authenticated users with access to LiteLLM LLM API routes or a key are affected by CVE-2026-59820.
Can CVE-2026-59820 be exploited remotely?
Yes, CVE-2026-59820 can potentially be exploited by remote authenticated users.