Executive brief
BentoML SSRF Vulnerability in File Upload Processing
Affected products
- PyPI bentoml
Junglewise Threat Intelligence
CVE-2025-54381: PYSEC-2026-297 - BentoML SSRF Vulnerability in File Upload Processing
CVE-2025-54381 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: bentoml (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2398 - BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
- bentoml OpenLLM command injection in Model Repository Directory Name Handler
- PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration
- PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary
- PYSEC-2026-296 - Insecure deserialization in BentoML