Executive brief
LiteLLM, a tool used to manage and connect various Artificial Intelligence (AI) models, contains a security flaw in how it handles 'skill' uploads. An authorized user could upload a specially crafted file that allows them to write data to restricted areas of the server's file system. This could lead to a complete service outage or allow an attacker to run unauthorized code on the system.
Technical details
A path traversal vulnerability (CWE-22) exists in LiteLLM's Skills archive extraction mechanism. The application fails to sufficiently validate file paths within uploaded ZIP archives. An authenticated attacker with access to the `/v1/skills` route (or keys with `llm_api_routes` or `anthropic_routes` permissions) can upload a crafted archive containing '../' sequences. When the server processes the skill for execution, it extracts files outside the intended staging directory. Depending on the environment's permissions, this arbitrary file write can be leveraged to overwrite system files or configuration, potentially leading to remote code execution (RCE). The issue is resolved in version 1.83.7-stable.
Affected products
- BerriAI LiteLLM < 1.83.7-stable
Timeline
- 2026-06-30: disclosed: Initial disclosure by jaydns
- 2026-07-08: advisory: NVD publication
- 2026-07-22: advisory: GitHub Advisory published
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9q
- https://github.com/BerriAI/litellm/pull/25475
- https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- https://api.github.com/repos/BerriAI/litellm/security-advisories/GHSA-5jmr-gcrj-2c9q