PyPI/bentoml CVE-2026-27905: high 7.8, EPSS 0.27%

BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

Action: Upgrade bentoml to 1.4.36 or later.

pip install bentoml==1.4.36

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2398
• nvd: CVE-2026-27905
• https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf
• https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670
• https://github.com/bentoml/BentoML
• https://pypi.org/project/bentoml
• https://github.com/advisories/GHSA-m6w7-qv66-g3mf

CVE-2026-27905 · published 2026-07-13T14:36:40.716464Z · modified 2026-07-13T16:31:38.609118661Z · JSON