CVE-2026-59820: LiteLLM Path Traversal Vulnerability

CVE-2026-59820 Overview

CVE-2026-59820 is a path traversal vulnerability [CWE-22] in LiteLLM, an AI Gateway proxy server that exposes LLM APIs in OpenAI-compatible format. Versions prior to 1.83.7-stable fail to validate file paths when extracting uploaded skill ZIP archives. An authenticated user with access to /v1/skills, anthropic_routes, or llm_api_routes can upload a crafted archive containing traversal entries. Extraction writes files outside the intended staging directory. The maintainers fixed the issue in version 1.83.7-stable.

Critical Impact
Authenticated attackers with skills route access can write arbitrary files outside the extraction directory, potentially overwriting configuration files or planting executable payloads on the LiteLLM proxy host.

Affected Products

LiteLLM proxy server versions prior to 1.83.7-stable
LiteLLM deployments exposing /v1/skills route
LiteLLM deployments exposing anthropic_routes or llm_api_routes on API keys

Discovery Timeline

2026-07-08 - CVE-2026-59820 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59820

Vulnerability Analysis

LiteLLM Skills allow users to upload ZIP archives containing prompt injection templates and sandboxed executable code. The extraction routine in litellm/llms/litellm_proxy/skills/sandbox_executor.py iterates entries from the uploaded archive and writes each file into a temporary staging directory using os.path.join(tmpdir, path). The routine does not canonicalize the resulting path or verify that it remains within the staging root.

When the archive contains entries with ../ sequences or absolute paths, os.path.join resolves the traversal and returns a location outside tmpdir. The extractor then creates parent directories and writes attacker-controlled bytes to that location. This grants arbitrary file write on the host process's file system.

Root Cause

The root cause is missing path validation during ZIP archive extraction, a classic Zip Slip pattern. The code trusts filenames embedded in the uploaded archive and passes them directly to filesystem APIs.

Attack Vector

Exploitation requires an authenticated caller with a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes. The attacker crafts a ZIP archive containing an entry such as ../../etc/litellm/config.yaml or a path targeting the Python site-packages directory. Uploading the archive through the skills endpoint triggers extraction and writes the attacker payload to the target path.

python

# Security patch in litellm/llms/litellm_proxy/skills/sandbox_executor.py
# Source: https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196

# Create a temp directory to stage files
with tempfile.TemporaryDirectory() as tmpdir:
    tmpdir_abs = os.path.abspath(tmpdir)
    for path, content in skill_files.items():
        # Create the file in temp directory
        local_path = os.path.abspath(os.path.join(tmpdir, path))
        if not local_path.startswith(tmpdir_abs + os.sep):
            verbose_logger.warning(
                f"SkillsSandboxExecutor: Skipping file with invalid path: {path}"
            )
            continue
        os.makedirs(os.path.dirname(local_path), exist_ok=True)
        with open(local_path, "wb") as f:
            f.write(content)

The patch resolves the absolute path of each target and verifies it starts with the staging directory prefix before writing. Entries that escape the staging root are logged and skipped. The companion change in litellm/llms/litellm_proxy/skills/prompt_injection.py imports posixpath to normalize archive-relative paths consistently.

Detection Methods for CVE-2026-59820

Indicators of Compromise

Unexpected files written under LiteLLM working directories, Python site-packages, or system configuration paths shortly after /v1/skills requests
LiteLLM audit or access logs containing POST requests to /v1/skills from keys not normally used for skill uploads
Skill archive uploads whose ZIP entries contain .. sequences, absolute paths, or path separators pointing outside expected directories
New or modified Python files under LiteLLM plugin or extension directories with recent timestamps

Detection Strategies

Inspect LiteLLM proxy access logs for requests to /v1/skills and correlate with subsequent filesystem changes on the host
Scan retained skill archive uploads with a ZIP validator that flags entries containing ../, absolute paths, or symbolic link entries
Monitor file integrity on LiteLLM configuration files, Python environment directories, and any writable path reachable from the proxy process user

Monitoring Recommendations

Enable verbose logging in LiteLLM to capture SkillsSandboxExecutor warnings introduced by the patch, which flag rejected traversal entries
Alert on process file writes originating from the LiteLLM Python interpreter that target paths outside its designated data directory
Track creation of API keys with allowed_routes including /v1/skills, anthropic_routes, or llm_api_routes and review those keys for legitimate use

How to Mitigate CVE-2026-59820

Immediate Actions Required

Upgrade LiteLLM to version 1.83.7-stable or later, which contains the path validation fix in commit 6a15adcd
Audit all API keys and remove /v1/skills, anthropic_routes, and llm_api_routes from allowed_routes unless the key requires skill upload capability
Review the LiteLLM host filesystem for unexpected files created since skills functionality was first enabled
Rotate any credentials or secrets accessible from the LiteLLM process user if compromise is suspected

Patch Information

The fix is available in the LiteLLM v1.83.7-stable release and merged via pull request #25475. See the GHSA-5jmr-gcrj-2c9q security advisory for maintainer guidance and the commit 6a15adcd for the exact code change.

Workarounds

Disable the skills feature by removing /v1/skills and related routes from every API key's allowed_routes configuration until upgrade is possible
Place the LiteLLM proxy behind a reverse proxy that blocks POST requests to /v1/skills for untrusted callers
Run the LiteLLM process under a dedicated unprivileged user with a read-only filesystem outside its data volume to limit damage from arbitrary write

bash

# Upgrade LiteLLM to the fixed release
pip install --upgrade 'litellm==1.83.7'

# Verify installed version
python -c "import litellm; print(litellm.__version__)"

# Temporary workaround: remove skills routes from key allowed_routes
# Example curl update against LiteLLM key management endpoint
curl -X POST https://litellm.example.com/key/update \
  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key": "sk-...", "allowed_routes": ["/v1/chat/completions"]}'