{"action":"Upgrade bentoml to 1.4.36 or later.","affected":[{"fixed":"1.4.36","introduced":"0"}],"component":"bentoml","cve_ids":["CVE-2026-27905"],"ecosystem":"PyPI","epss":0.00293,"exploited":false,"fixed_versions":["1.4.36"],"ghsa_id":"GHSA-m6w7-qv66-g3mf","id":"tcs_01M5KFQGAFT1A6Q305QQJDDZ6B","modified_at":"2026-07-13T16:43:31.737282240Z","published_at":"2026-03-03T17:46:47Z","references":["https://osv.dev/vulnerability/GHSA-m6w7-qv66-g3mf","https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf","https://nvd.nist.gov/vuln/detail/CVE-2026-27905","https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670","https://github.com/bentoml/BentoML"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-m6w7-qv66-g3mf","url":"https://osv.dev/vulnerability/GHSA-m6w7-qv66-g3mf"},{"source":"nvd","source_id":"CVE-2026-27905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27905"}],"summary":"BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction"}