Executive brief
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Affected products
- PyPI bentoml
Junglewise Threat Intelligence
CVE-2026-27905: PYSEC-2026-2398 - BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
CVE-2026-27905 · Severity: medium · CVSS 4 · Published 2026-07-13
Technologies: bentoml (PyPI). Vendors: PyPI.
Related threats
- bentoml OpenLLM command injection in Model Repository Directory Name Handler
- PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration
- PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary
- PYSEC-2026-296 - Insecure deserialization in BentoML
- PYSEC-2026-297 - BentoML SSRF Vulnerability in File Upload Processing