CVE-2026-24123

Katalog CVE

CVSS 6.5 · Medium EPSS 0,50%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada bentoml. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.

Rincian

Terbit di NVD

26 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf advisory vendor
• https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4 patch
• https://github.com/bentoml/BentoML/releases/tag/v1.4.34 product · release notes