CVE-2026-59820 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Medium 6.1 Published 8 Jul 2026 Updated 9 Jul 2026

Authenticated users can upload crafted skill archives to write files outside the intended directory via path traversal in LiteLLM.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59820?

CVE-2026-59820 is a medium-severity path traversal vulnerability in BerriAI litellm, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.

Weakness: CWE-22

Which versions are affected by CVE-2026-59820?

3 open source packages ship an affected version, including litellm. It affects 1 product.

Package	Affected	Fixed in
`litellm` PyPI	All versions	`1.83.7`
`litellm` PyPI	All versions	`1.83.7`
`litellm` PyPI	All versions	`1.83.7`

Products include Litellm Litellm.

How do I fix CVE-2026-59820?

Upgrade litellm to 1.83.7 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-59820 being exploited?

There is no known exploitation of CVE-2026-59820 in the wild and no public exploit code.

Sources

Also known as ECHO-15ef-6486-8fd7, GHSA-5jmr-gcrj-2c9q, MINI-2xj5-fpg4-vr8x, MINI-6phm-8mq6-g52j, MINI-8m5q-qxph-pcqr, MINI-j62p-8h4x-cf75 and 3 more.