GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Executive Summary

Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive co...