GHSA-m6w7-qv66-g3mf
NoneCVSS
—
EPSS
—
Published
Mar 3, 2026
CISA due date
—
The record
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | bentoml | 0 | 1.4.36 |
Related vulnerabilities
- CVE-2026-27905 BentoML is a Python library for building online serving systems optimized for AI apps and… Same vulnerability
- CVE-2026-24123 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
- GHSA-6r62-w2q3-48hf BentoML has a Path Traversal via Bentofile Configuration Also affects bentoml
- CVE-2025-54381 BentoML SSRF Vulnerability in File Upload Processing Also affects bentoml
- CVE-2025-32375 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure… Also affects bentoml
- CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization Also affects bentoml
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22