GHSA-6r62-w2q3-48hf
High · 7.4CVSS
7.4
EPSS
—
Published
Jan 26, 2026
CISA due date
—
The record
BentoML has a Path Traversal via Bentofile Configuration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | bentoml | 0 | 1.4.34 |
Related vulnerabilities
- CVE-2026-24123 BentoML is a Python library for building online serving systems optimized for AI apps and… Same vulnerability
- CVE-2026-27905 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
- GHSA-m6w7-qv66-g3mf BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction Also affects bentoml
- CVE-2025-54381 BentoML SSRF Vulnerability in File Upload Processing Also affects bentoml
- CVE-2025-32375 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure… Also affects bentoml
- CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization Also affects bentoml
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22