LiteLLM is a proxy server that enables clients to call large language model APIs. A flaw in versions earlier than 1.83.7‐stable allows an authenticated user with permission to upload a skill ZIP archive to embed path traversal entries. When the archive is processed, the server extracts files without properly limiting the destination pathname, permitting the attacker to write files outside the intended extraction or staging directory. This flaw, categorized as CWE‑22, can lead to the modification of files that are not part of the uploaded skill, potentially affecting system configuration or installing malicious code. The vulnerability is limited to local file modification; it does not explicitly grant remote code execution or privilege escalation beyond the files that can be overwritten.

BerriAI’s LiteLLM proxy server is vulnerable when any version prior to 1.83.7‑stable is running. Users who have enabled skill uploads through the /v1/skills, anthropic_routes, or llm_api_routes API routes are at risk, as those endpoints allow the crafted archives to be submitted by authenticated callers or by keys whose allowed_routes include the mentioned paths.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, implying that exploitation is unlikely to be widespread at this time. According to the description, exploitation would involve an authorized user creating a ZIP archive containing traversal paths and submitting it via the vulnerable API routes. Once processed, the malformed paths could overwrite arbitrary files on the host where LiteLLM is running, enabling local file write.