Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-07-08 | 1 | Active Exploitation1 |
| 2026-07-13 | 1 | Disclosure1 |
🟠 LiteLLM, Path Traversal, #CVE-2026-59820 (Medium) -DC-Jul2026-911 https://dailycve.com/litellm-path-traversal-cve-2026-59820-medium-dc-jul2026-911/
Post summary
The content announces a new Medium‑severity Path Traversal vulnerability in LiteLLM (CVE‑2026‑59820) without providing PoC, exploit code, or mitigation details.
⚠️ HIGH — CVE-2026-59820 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM S… CVSS 6.1 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-59820 #OpenAI #CyberSecurity #InfoSec
Post summary
CVE‑2026‑59820, affecting LiteLLM, has a CVSS score of 6.1 and is reported as ‘Exploit in the wild’, with a full analysis available at the provided link.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | litellm | litellm | - | - | - |
| App | litellm | litellm | 1.83.7 | - | - |