BentoML 1.x < 1.4.8 Insecure Deserialization

According to its banner, the version of BentoML running on the remote host is 1.x 1.4.8. It is, therefore, affected by an Insecure Deserialization vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

BentoML 1.3.4 < 1.4.3 Insecure Deserialization

According to its banner, the version of BentoML running on the remote host is 1.3.4 1.4.3. It is, therefore, affected by an Insecure Deserialization vulnerability through data flow analysis Note that the scanner has not tested for these issues but has instead relied only on the application's...

CVE-2025-54381

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

BentoML Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible BentoML instance on the target application. BentoML is an open-source inference platform. This detection is included in the AI and LLM category. No source data...

CVE-2025-54381

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

CVE-2025-54381

CVE-2025-54381 affects BentoML and its file-upload processing in versions 1.4.0–1.4.19. The vulnerability arises in the multipart form data and JSON request handlers, which download user-provided URLs without validating whether they point to internal networks, cloud metadata endpoints, or other r...

CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP...

Server-side Request Forgery (SSRF)

Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the MultipartSerde. ensurefile and JSONSerde.parserequest processes. An attacker can cause the server to make arbitrary HTTP requests to...

GHSA-MRMQ-3Q62-6CC8 BentoML SSRF Vulnerability in File Upload Processing

Description There's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatical...

PT-2025-31269

Name of the Vulnerable Software and Affected Versions BentoML versions 1.4.0 through 1.4.19 Description BentoML contains a Server-Side Request Forgery SSRF issue in the file upload processing system. This allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests...

BentoML 代码问题漏洞

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions 1.4.0 through 1.4.19 that stems from the file upload processing...

BentoML 1.x < 1.4.8 Arbitrary Code Execution

The version of the BentoML library installed on the remote host has an arbitrary code execution vulnerability. BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner serve...

The vulnerability of the serde.py component in the BentoML library allows a hacker to execute arbitrary code on the server.

The vulnerability of the serde.py component in the BentoML library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code on the server...

📄 BentoML Runner Server Remote Code Execution

There was an insecure deserialization in BentoML's runner server prior to version 1.4.8. By setting specific headers and parameters in the POST request, it is possible to execute unauthorized arbitrary code in the context of the user running the server, which will grant initial access and...

Metasploit Wrap-Up 04/18/2025

Smaller Fetch Payloads This week, a significant enhancement was made to the already awesome fetch payload feature by our very own bwatters-r7. The improvement introduces a new option, PIPEFETCH, which optimizes the process by serving both the payload and the command to be executed simultaneously...

Remote Code Execution (RCE)

BentoML is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of specific headers and parameters in POST requests, which allows remote code execution RCE on the server...

📄 BentoML 1.4.2 Remote Code Execution

A remote code execution vulnerability caused by insecure deserialization has been identified in version 1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. This module requires Metasploit: https://metasploit.com/download Current source:...

Remote Code Execution (RCE)

BentoML is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization due to an unsafe code segment in serde.py that allows arbitrary code execution by unauthenticated users...