PT-2026-22843 · Bentoml · Bentoml

Q1Uf3Ng · Published 2026-03-03 · Updated 2026-03-25 · CVE-2026-27905

Positive Technologies · (AI Summary)

CVSS v4.0

8.6

High

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.36

Description BentoML is a Python library used for building online serving systems for AI applications and model inference. The safe extract tarfile() function does not fully validate symlink targets within tar files, potentially allowing an attacker to write arbitrary files on the host filesystem. Specifically, the function validates the symlink's path but not the path to which the symlink points. An attacker can create a malicious tar file containing a symlink that points outside the intended extraction directory, followed by a file that, when extracted, writes data through the symlink to a location outside the extraction directory.

Recommendations Update BentoML to version 1.4.36 or later.

Fix

Path traversal

Link Following

Weakness Enumeration

CWE-22

CWE-59

Related Identifiers

CVE-2026-27905

GHSA-M6W7-QV66-G3MF

Affected Products

Bentoml

References · 10

• https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf · Vendor Advisory
• https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27905 · Security Note
• https://osv.dev/vulnerability/GHSA-m6w7-qv66-g3mf · Vendor Advisory
• https://github.com/bentoml/BentoML · Note
• https://t.me/CVEtracker/46258 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029065017329361217 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028975244803809432 · Twitter Post
• https://twitter.com/CVEnew/status/2028974431205306403 · Twitter Post