237 matches found
BentoML 后置链接漏洞
BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Prior to BentoML 1.4.36, there was a post-link vulnerability. This vulnerability stemmed from the safeextracttarfile function,...
BentoML < 1.4.34 Path Traversal
The version of the BentoML library installed on the remote host is prior to 1.4.34. It is, therefore, affected by a path traversal vulnerability: - BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript,...
BentoML v1.3.9 - Open Redirect
An open redirect vulnerability exists in BentoML v1.3.9, where the file parameter in the /ui/gradioapi/file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. id: CVE-2024-12760 inf...
CVE-2026-24123
Summary: CVE-2026-24123 affects BentoML before version 1.4.34, enabling path traversal via bentofile.yaml fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). An attacker can craft a malicious bentofile that, when built, exfiltrates arbitrary files from th...
CVE-2026-24123 BentoML has a Path Traversal via Bentofile Configuration
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...
Directory Traversal
Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Directory Traversal via the processing of user-supplied file paths in configuration fields description, docker.setupscript, docker.dockerfiletemplate, and conda.environmentyml...
BentoML has a Path Traversal via Bentofile Configuration
Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...
CVE-2026-24123: Improper Limitation of a Pathname to a Restricted Directory
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...
PT-2026-4828
Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.34 Description BentoML contains a path traversal flaw in the bentofile.yaml configuration. An attacker can craft a malicious bentofile.yaml that, when processed by BentoML, allows the exfiltration of arbitrary fil...
CVE-2024-2912
An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution RCE by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is...
The vulnerability of the BentoML library, related to insufficient validation of requests on the server side, allows a attacker to execute an SSRF attack.
The vulnerability of the BentoML library is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...
BentoML runner server deserialization vulnerability
Added: 10/24/2025 CVE: CVE-2024-9070 Background BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Problem A deserialization vulnerability in the BentoML runner server allows remote attackers to execute arbitrary commands by sending a...
BentoML runner server deserialization vulnerability
Added: 10/24/2025 CVE: CVE-2024-9070 Background BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Problem A deserialization vulnerability in the BentoML runner server allows remote attackers to execute arbitrary commands by sending a...
EUVD-2025-6875
Malicious code in bioql PyPI...
EUVD-2025-6868
Malicious code in bioql PyPI...
EUVD-2025-23049
Malicious code in bioql PyPI...
EUVD-2025-7007
Malicious code in bioql PyPI...
EUVD-2024-1219
Malicious code in bioql PyPI...
