PyPI/bentoml CVE-2026-24123: high 7.4, EPSS 0.49%
BentoML has a Path Traversal via Bentofile Configuration
Action: Upgrade bentoml to 1.4.34 or later.
pip install bentoml==1.4.34Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.34 | - |
Fixed versions
| 1.4.34 |
Sources
- osv: PYSEC-2026-1218
- https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf
- https://nvd.nist.gov/vuln/detail/CVE-2026-24123
- https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4
- https://github.com/bentoml/BentoML
- https://github.com/bentoml/BentoML/releases/tag/v1.4.34
- https://pypi.org/project/bentoml
- https://github.com/advisories/GHSA-6r62-w2q3-48hf
CVE-2026-24123 · published · modified · JSON