LiteLLM Skills Archive Path Traversal Arbitrary File Write

Technical Analysis

The vulnerability is a classic path traversal (zip-slip) flaw in LiteLLM's Skills archive extraction logic, where ZIP entry names containing sequences like '../../' are not sanitized before being used to construct extraction file paths. The entry point is the `/v1/skills` upload endpoint, accessible to authenticated users or API keys whose `allowed_routes` include skills-related routes (`/v1/skills`, `anthropic_routes`, `llm_api_routes`). An attacker gains the ability to write attacker-controlled content to arbitrary filesystem locations reachable by the LiteLLM process, which could overwrite configuration files, cron jobs, application code, or startup scripts to achieve code execution. This crosses the tool/agent boundary because Skills are packaged executable capabilities loaded into the LLM gateway's runtime, meaning a malicious archive uploaded through a routine API interaction can compromise the underlying host or proxy infrastructure that mediates all LLM traffic.

Affected Systems

LiteLLM

Detection Signatures

• ZIP archive entries containing path traversal sequences (e.g., '../', '..\\', absolute paths) in filenames
• Unexpected file writes outside designated skills staging/extraction directories on LiteLLM hosts
• POST requests to /v1/skills from unexpected or low-privilege API keys
• File integrity monitoring alerts on config files, cron directories, or startup scripts following skill uploads
• Log entries showing skill archive processing errors or unusual extraction paths

Remediation Steps

1. 1

   Upgrade LiteLLM

   Update to litellm 1.83.7-stable or later, which fixes the path traversal validation in Skills archive extraction.

2. 2

   Restrict Skills API access

   Limit which users and API keys have allowed_routes including /v1/skills, anthropic_routes, or llm_api_routes to only trusted, minimal-privilege accounts.

3. 3

   Block endpoint at gateway

   If upgrading is not immediately possible, block POST /v1/skills at the reverse proxy or API gateway layer.

4. 4

   Sandbox extraction

   Ensure skill archive extraction occurs in an isolated, non-privileged directory/container with no write access to sensitive host paths.

5. 5

   Monitor file system changes

   Deploy file integrity monitoring on directories used for skill staging and on critical system paths to detect anomalous writes.