CVE-2026-24123

The record

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.

Affected packages

Related vulnerabilities

• GHSA-6r62-w2q3-48hf BentoML has a Path Traversal via Bentofile Configuration Same vulnerability
• CVE-2026-27905 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
• GHSA-m6w7-qv66-g3mf BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction Also affects bentoml
• CVE-2025-54381 BentoML SSRF Vulnerability in File Upload Processing Also affects bentoml
• CVE-2025-32375 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure… Also affects bentoml
• CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization Also affects bentoml
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
• CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22