CVE-2026-27905

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27905", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T15:19:29.718Z", "datePublished": "2026-03-03T22:45:40.434Z", "dateUpdated": "2026-03-04T21:23:39.612Z"}, "containers": {"cna": {"title": "BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf"}, {"name": "https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670", "tags": ["x_refsource_MISC"], "url": "https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670"}], "affected": [{"vendor": "bentoml", "product": "BentoML", "versions": [{"version": "< 1.4.36", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-03T22:45:40.434Z"}, "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36."}], "source": {"advisory": "GHSA-m6w7-qv66-g3mf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:23:29.847681Z", "id": "CVE-2026-27905", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:23:39.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27905", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T21:23:29.847681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:23:35.012Z"}}], "cna": {"title": "BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction", "source": {"advisory": "GHSA-m6w7-qv66-g3mf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bentoml", "product": "BentoML", "versions": [{"status": "affected", "version": "< 1.4.36"}]}], "references": [{"url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf", "name": "https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670", "name": "https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-03T22:45:40.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27905", "state": "PUBLISHED", "dateUpdated": "2026-03-04T21:23:39.612Z", "dateReserved": "2026-02-24T15:19:29.718Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-03T22:45:40.434Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BentoML", "vendor": "bentoml", "versions": [{"status": "affected", "version": "< 1.4.36"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDC86E82-4716-43D1-AC14-3934F86B38E8", "versionEndExcluding": "1.4.36", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36."}, {"lang": "es", "value": "BentoML es una librer\u00eda de Python para construir sistemas de servicio en l\u00ednea optimizados para aplicaciones de IA e inferencia de modelos. Antes de la versi\u00f3n 1.4.36, la funci\u00f3n safe_extract_tarfile() valida que la ruta de cada miembro del archivo tar est\u00e9 dentro del directorio de destino, pero para los miembros de enlace simb\u00f3lico solo valida la ruta del propio enlace simb\u00f3lico, no el objetivo del enlace simb\u00f3lico. Un atacante puede crear un archivo tar malicioso bento/model que contenga un enlace simb\u00f3lico que apunte fuera del directorio de extracci\u00f3n, seguido de un archivo regular que escriba a trav\u00e9s del enlace simb\u00f3lico, logrando una escritura de archivo arbitraria en el sistema de archivos del host. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.4.36."}], "id": "CVE-2026-27905", "lastModified": "2026-10-07T08:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27905", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:23:29.847681Z", "version": "2.0.3"}}]}, "published": "2026-03-03T23:15:55.897", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.36)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BentoML", "source": "cna", "vendor": "bentoml"}, "product": "bentoml", "vendor": "bentoml"}], "analysis": {"en": {"generated_at": "2026-04-16T13:50:10.630331+00:00", "value": {"mitigation_remediation": ["Upgrade BentoML to version 1.4.36 or later", "Ensure that only trusted tar archives are processed by safe_extract_tarfile", "Run tar extraction commands in a sandboxed or isolated environment to limit the impact of any potential file write"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects versions of BentoML older than 1.4.36. The issue is present in all installations that use the safe_extract_tarfile routine before the 1.4.36 release, regardless of deployment environment. Upgrading to version 1.4.36 or later applies the patch that fully validates symlink targets.", "description_and_impact": "BentoML\u2019s safe_extract_tarfile function is intended to prevent tar extraction from writing files outside the intended destination directory. The function validates only the symlink\u2019s own path, not the target of the link. An attacker who can supply a malicious tar archive can create a symlink that points outside the extraction folder and a regular file that resolves through that symlink, causing an arbitrary file write on the host filesystem. This allows modification or creation of any file on the system where the extraction occurs, potentially compromising application code, configuration, or system binaries.", "risk_and_exploitability": "The CVSS score of 8.6 rates this as high severity, and the EPSS score of less than 1\u00a0% indicates that exploitation probability is low as of the current data set. The vulnerability is not listed in the CISA KEV catalog. If an attacker can control the content of a tar file that is extracted by BentoML, they can write an arbitrary file through a symlink, making the risk significant while the likelihood of exploitation remains modest. The attack requires the attacker\u2019s input to the tar extraction process; no additional privileges are needed beyond the execution context of the extraction routine."}}}}, "created": "2026-03-04T14:53:30.453292+00:00", "updated": "2026-04-16T14:00:19.462631+00:00", "vendors": ["bentoml", "bentoml$PRODUCT$bentoml"]}