Every CVE Search/ Get API key

CVE-2026-59820

LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

6.1 MediumFix available

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.59%Up 0.3 points since Jul 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Record
CVE-2026-59820
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-42357 6.1

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Record
EUVD-2026-42357
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5jmr-gcrj-2c9q 6.1

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

Patches

The issue is fixed in 1.83.7-stable.

LiteLLM recommens upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Block POST /v1/skills at your reverse proxy or API gateway.
  2. Restrict Skills API access to trusted users only.
Record
GHSA-5jmr-gcrj-2c9q
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.1

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Record
CVE-2026-59820
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.1

LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Record
CVE-2026-59820
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-5jmr-gcrj-2c9q 6.1

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

Patches

The issue is fixed in 1.83.7-stable.

LiteLLM recommens upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Block POST /v1/skills at your reverse proxy or API gateway.
  2. Restrict Skills API access to trusted users only.
Record
GHSA-5jmr-gcrj-2c9q
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVPYSEC-2026-3477 6.1

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact

LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes, could upload a crafted skill archive containing path traversal entries.

When the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.

Patches

The issue is fixed in 1.83.7-stable.

LiteLLM recommens upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Block POST /v1/skills at your reverse proxy or API gateway.
  2. Restrict Skills API access to trusted users only.
Record
PYSEC-2026-3477
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
litellm
PyPI
 before 1.83.7
1.83.7
litellm
PyPI
 before 1.83.7, plus listed versions
0.1.00.1.10.1.20.1.2010.1.202
Show 45 moreShow less
0.1.2030.1.2040.1.2050.1.2060.1.2070.1.2080.1.2090.1.2100.1.2110.1.2120.1.2130.1.2140.1.2150.1.2160.1.2170.1.2180.1.2190.1.2200.1.2210.1.2220.1.2230.1.2240.1.2250.1.2260.1.2270.1.2280.1.2290.1.22910.1.2300.1.2310.1.2320.1.2330.1.2340.1.2350.1.2360.1.2370.1.2380.1.30.1.310.1.320.1.3300.1.3310.1.340.1.3410.1.343
1.83.7
litellm
PyPI
 before 1.83.7, plus listed versions
0.1.00.1.10.1.20.1.2010.1.202
Show 45 moreShow less
0.1.2030.1.2040.1.2050.1.2060.1.2070.1.2080.1.2090.1.2100.1.2110.1.2120.1.2130.1.2140.1.2150.1.2160.1.2170.1.2180.1.2190.1.2200.1.2210.1.2220.1.2230.1.2240.1.2250.1.2260.1.2270.1.2280.1.2290.1.22910.1.2300.1.2310.1.2320.1.2330.1.2340.1.2350.1.2360.1.2370.1.2380.1.30.1.310.1.320.1.3300.1.3310.1.340.1.3410.1.343
1.83.7

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59820 is a medium vulnerability (CVSS 6.1) in Berriai Litellm, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in litellm 1.83.7.

References

This page doesn't list everything

Left out here: 1,742 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open