GHSA-5jmr-gcrj-2c9q
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Quick fix
GHSA-5jmr-gcrj-2c9q — litellm: upgrade to the fixed version with the command below.
pip install --upgrade 'litellm>=1.83.7'Details
### Impact
LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted skill archive containing path traversal entries.
When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.
### Patches
The issue is fixed in `1.83.7-stable`.
LiteLLM recommens upgrading to `1.83.7-stable` or later.
### Workarounds
If upgrading is not immediately possible:
1. Block `POST /v1/skills` at your reverse proxy or API gateway. 2. Restrict Skills API access to trusted users only.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9q [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-59820 [ADVISORY]
- https://github.com/BerriAI/litellm/pull/25475 [WEB]
- https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196 [WEB]
- https://github.com/BerriAI/litellm [PACKAGE]
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable [WEB]