Cloudanix VulnDB

CVE-2025-54381

Critical · 9.9

BentoML SSRF Vulnerability in File Upload Processing

CVSS

9.9

EPSS

16.2%

Published

Jul 29, 2025

CISA due date

—

The record

There's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses. The framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services. The documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default.

Affected packages

Ecosystem Package Introduced Fixed
PyPI bentoml 1.4.0 1.4.19
pypi bentoml 1.4.0 No fix

Related vulnerabilities