CVE-2026-27905: BentoML Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Summary
CVE-2026-27905: BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction. Affects bentoml versions < 1.4.36. Fixed in 1.4.36. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BentoML is an open-source framework designed for simplifying the deployment of machine learning models. It allows users to package models into 'bentos' and deploy them to various cloud platforms. The framework provides utilities for managing model files and dependencies, making it easier for data scientists and developers to serve their models. However, a vulnerability exists in the tar extraction process, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from the safe_extract_tarfile() function in BentoML, which fails to properly validate symlink targets during tar file extraction. While the function checks that the symlink's own path is within the destination directory, it does not validate where the symlink points. An attacker can create a malicious tar file containing a symlink that points outside the intended extraction directory, allowing arbitrary file writes on the host filesystem. This can lead to severe consequences, including overwriting critical files and potential remote code execution.
How To Fix
Latest published version: 1.4.39 as of 23 Oct 2026
pip install --upgrade "bentoml==1.4.39"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.36
This is the first release that contains the fix.
pip install --upgrade "bentoml==1.4.36"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate symlink targets before extraction. Modify the safe_extract_tarfile() function as follows:
if member.issym():
target = os.path.normpath(os.path.join(os.path.dirname(path), member.linkname))
if not Path(target).is_relative_to(destination):
logger.warning('Symlink %s points outside: %s', member.name, member.linkname)
continue
This code checks if the symlink target is within the allowed directory before proceeding with the extraction.
Conclusion
CVE-2026-27905 presents a significant security risk for users of BentoML due to improper validation of symlink targets during tar extraction. It is crucial to update to the patched version or implement the suggested workaround to safeguard against potential exploitation.
See every vulnerability recorded for bentoml →
FAQ
CVE-2026-27905 is a vulnerability in BentoML that allows arbitrary file writes via symlink path traversal during tar extraction.
An attacker can create a malicious tar file with a symlink pointing outside the extraction directory, allowing them to overwrite files on the host system.
Exploitation can lead to arbitrary file overwrites, remote code execution, and compromise of systems that pull malicious bentos from BentoCloud.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
If immediate updates are not possible, implement the provided workaround to validate symlink targets before extraction to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for bentoml.
