Is there a patch available for CVE-2026-59820?

Yes, a patch is available for CVE-2026-59820. Update the affected software to the latest version immediately.

LiteLLM CVE-2026-59820

Q: What is the CVSS score of CVE-2026-59820?

CVE-2026-59820 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42357 MEDIUM

Path Traversal (CWE-22)

2026-07-08 GitHub_M

GHSA-5jmr-gcrj-2c9q

Path Traversal Red Hat Litellm Berriai

6.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-accessible upload endpoint with low privilege (authenticated key with route scope); no confidentiality impact described; integrity and availability both High due to arbitrary file write.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:49 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 pypi packages depend on litellm (12 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.83.7.

DescriptionCVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

AnalysisAI

Path traversal in LiteLLM's Skills archive extraction enables authenticated users with access to specific LLM API routes to write arbitrary files outside the intended server extraction directory by uploading a crafted ZIP archive containing path traversal entries. Affected versions are all LiteLLM releases prior to 1.83.7-stable; the CPE confirms the entire berriai/litellm product line is in scope. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the integrity and availability impact is rated High in the vendor-provided CVSS 4.0 vector, making this a meaningful risk for any LiteLLM deployment that exposes the Skills upload feature to untrusted authenticated users.

Technical ContextAI

LiteLLM (CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source AI Gateway proxy that normalizes calls across LLM providers such as OpenAI, Anthropic, and others. The Skills feature allows authenticated callers to upload ZIP archives defining custom skill bundles, which the server extracts to a staging or installation directory. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the extraction routine failed to canonicalize or sanitize member file paths within the uploaded ZIP before writing them to disk, allowing entries such as '../../etc/cron.d/evil' to resolve outside the intended target directory. This is a classic Zip Slip vulnerability pattern where archive member names containing path traversal sequences ('..') are written relative to the server's working directory rather than a restricted sandbox.

RemediationAI

Upgrade LiteLLM to version 1.83.7-stable or later; this is the vendor-confirmed fix documented in GitHub release tag v1.83.7-stable, security advisory GHSA-5jmr-gcrj-2c9q, and implemented via commit 6a15adcd64137d37f73dee76dfe7481f8c2d9196 (PR #25475). If an immediate upgrade is not feasible, restrict API key allowed_routes to exclude /v1/skills, anthropic_routes, and llm_api_routes for any key issued to untrusted or externally-facing callers - this eliminates the attack surface since the vulnerability requires access to these specific routes. As a further defense-in-depth measure, run the LiteLLM process under a dedicated low-privilege OS account with write access limited to its own application directories, so that even a successful path traversal cannot overwrite sensitive system files. Note that restricting routes requires modifying key configuration and may break workflows relying on Skills-based functionality.