CVE-2026-27905: high-severity vulnerability in BentoML
BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.3%
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
bentoml · BentoMLRelated CVEs — BentoML
In the same product, most dangerous first.
CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2025-27520CRITICALBentoML Allows Remote Code Execution (RCE) via Insecure DeserializationEPSS 40.6%CVE-2025-54381CRITICALBentoML is Vulnerable to an SSRF Attack Through File Upload ProcessingEPSS 13.2%CVE-2026-24123HIGHBentoML has a Path Traversal via Bentofile ConfigurationEPSS 0.5%CVE-2026-78205MEDIUMBentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address SpaceEPSS 0.4%CVE-2026-35044HIGHBentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generationEPSS 0.4%