CVE-2026-27905

The record

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36.

Affected packages

Related vulnerabilities

• GHSA-m6w7-qv66-g3mf BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction Same vulnerability
• CVE-2026-24123 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
• GHSA-6r62-w2q3-48hf BentoML has a Path Traversal via Bentofile Configuration Also affects bentoml
• CVE-2025-54381 BentoML SSRF Vulnerability in File Upload Processing Also affects bentoml
• CVE-2025-32375 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure… Also affects bentoml
• CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization Also affects bentoml
• CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59