7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24123

CVE-2026-24123: BentoML has a Path Traversal via Bentofile Configuration

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24123

CVE-2026-24123:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bentoml	pip	< 1.4.34	1.4.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in BentoML, identified as GHSA-6r62-w2q3-48hf. The root cause lies in the bentoml._internal.utils.filesystem.resolve_user_filepath function, which failed to properly sanitize and restrict file paths provided by users in the bentofile.yaml configuration file. This allowed an attacker to craft a malicious bentofile.yaml that, when used in a bentoml build command, could read arbitrary files from the build environment's filesystem.

The vulnerability could be triggered through several fields in bentofile.yaml, including description, docker.setup_script, docker.dockerfile_template, and conda.environment_yml. An attacker could specify paths using traversal sequences (../), absolute paths (/etc/passwd), or even paths to sensitive process information (/proc/self/environ) to exfiltrate data like SSH keys, cloud credentials, and environment variables.

The patch addresses the vulnerability by rewriting the resolve_user_filepath function to include strict security checks. The new implementation introduces a secure mode (enabled by default) which:

Disallows absolute paths.
Ensures the resolved file path is within the current working directory (build context).
Prevents access to hidden files and system directories like /etc and /proc.

Functions that process the vulnerable fields, such as _build_from_build_config (for the description field) and Image.run_script (for docker.setup_script), were updated to use this new, secure utility function. This comprehensive fix mitigates the path traversal risk across the various attack vectors.

Vulnerable functions

bentoml._internal.utils.filesystem.resolve_user_filepath

src/bentoml/_internal/utils/filesystem.py

This function is the root cause of the vulnerability. Before the patch, it resolved user-provided file paths using `os.path.expanduser`, `os.path.expandvars`, and `os.path.realpath` without any validation to ensure the resulting path was within the expected build context. This allowed an attacker to use path traversal sequences (`../`), absolute paths (`/etc/passwd`), or environment variables to access arbitrary files on the filesystem.

bentoml._internal.bento.bento._build_from_build_config

src/bentoml/_internal/bento/bento.py

This function processes the `description` field from the `bentofile.yaml`. If the field starts with `file:`, the function would use the rest of the string as a file path and copy its content. The original implementation performed no path validation, allowing an attacker to specify a path like `file:../../../etc/passwd` to read arbitrary files. The patch fixes this by calling the secured `resolve_user_filepath` function.

_bentoml_sdk.images.Image.run_script

src/_bentoml_sdk/images.py

This method is used to handle the `docker.setup_script` field from `bentofile.yaml`. The original implementation resolved the script path using `Path(script).resolve()`, which could allow a path traversal. The patch changes this to use the now-secure `resolve_user_filepath` function, preventing the vulnerability.

_bentoml_sdk.images.populate_image_from_build_config

src/_bentoml_sdk/images.py

This function reads build options from the configuration, including `docker_options.setup_script`. It then passes this user-provided path to the `image.run_script` method. This function is part of the chain that leads to the exploitation of the path traversal vulnerability when processing the `docker.setup_script` field.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.