Executive brief
BentoML has a Path Traversal via Bentofile Configuration
Affected products
- PyPI bentoml
Junglewise Threat Intelligence
CVE-2026-24123: PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration
CVE-2026-24123 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: bentoml (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2398 - BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
- bentoml OpenLLM command injection in Model Repository Directory Name Handler
- PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary
- PYSEC-2026-296 - Insecure deserialization in BentoML
- PYSEC-2026-297 - BentoML SSRF Vulnerability in File Upload Processing