{"action":"Upgrade bentoml to 1.4.36 or later.","affected":[{"fixed":"1.4.36","introduced":"0"}],"component":"bentoml","cve_ids":["CVE-2026-27905"],"ecosystem":"PyPI","epss":0.00267,"exploited":false,"fixed_versions":["1.4.36"],"ghsa_id":"GHSA-m6w7-qv66-g3mf","id":"tcs_01M5KGZ7QQ0PTSFSEFRB7CFT1X","modified_at":"2026-07-13T16:31:38.609118661Z","published_at":"2026-07-13T14:36:40.716464Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2398","https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf","https://nvd.nist.gov/vuln/detail/CVE-2026-27905","https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670","https://github.com/bentoml/BentoML","https://pypi.org/project/bentoml","https://github.com/advisories/GHSA-m6w7-qv66-g3mf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-2398","url":"https://osv.dev/vulnerability/PYSEC-2026-2398"}],"summary":"BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction"}