LiteLLM EUVD-2026-42357

Exploitation requires the attacker to possess a valid LiteLLM API key whose allowed_routes configuration includes at least one of: /v1/skills, anthropic_routes, or llm_api_routes. This is an explicitly configured per-key permission, not granted by default to all authenticated users. The LiteLLM Skills feature must be enabled and reachable on the target deployment. Exploitation is limited to authenticated users (CVSS PR:L) - unauthenticated attackers cannot reach the upload endpoint. The CVSS AT:P metric confirms a specific attack requirement: possession of a key with the relevant route scope. Deployments that do not use the Skills feature or that restrict Skills route access to internal service identities are not realistically at risk despite the network-accessible vector.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H) scores 6.1 (Medium). The AT:P (Attack Requirements: Present) metric is the key moderating factor - exploitation requires the attacker to hold an authenticated API key whose allowed_routes explicitly includes /v1/skills, anthropic_routes, or llm_api_routes, which is a non-default, operator-controlled permission. The integrity and availability impacts are both High, reflecting that successful exploitation enables arbitrary file writes that could overwrite configuration files, plant malicious scripts, or disrupt the application. No EPSS score was provided in the intelligence, and no CISA KEV listing exists, consistent with no confirmed in-the-wild exploitation. There is no conflicting signal between the CVSS vector and the description - the network-accessible upload endpoint and low-privilege requirement are coherent. Real-world priority is moderate: organizations whose LiteLLM deployments grant Skills route access to externally-facing or untrusted API keys should treat this as urgent; deployments where Skills routes are restricted to internal service accounts face substantially lower risk.

An attacker holding a LiteLLM API key with access to the /v1/skills route constructs a ZIP archive containing a file with a path such as '../../app/litellm/startup.py' (or another sensitive application or OS path), then submits it to the Skills upload endpoint. The server extracts the archive without sanitizing the traversal sequences, overwriting the target file with attacker-controlled content. No public proof-of-concept code has been identified, but the Zip Slip technique is well-documented and straightforward to implement against unpatched path extraction routines.