CVE-2026-24123: high-severity vulnerability in BentoML
BentoML has a Path Traversal via Bentofile Configuration
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.4epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
bentoml · BentoMLRelated CVEs — BentoML
In the same product, most dangerous first.
CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2025-27520CRITICALBentoML Allows Remote Code Execution (RCE) via Insecure DeserializationEPSS 40.6%CVE-2025-54381CRITICALBentoML is Vulnerable to an SSRF Attack Through File Upload ProcessingEPSS 16.1%CVE-2026-35044HIGHBentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generationEPSS 0.5%CVE-2026-44345HIGHBentoML: Dockerfile command injection via docker.base_imageEPSS 0.5%CVE-2026-44346HIGHBentoML: Dockerfile command injection via envs[*].name in bentofile.yamlEPSS 0.5%