Is bentoml affected by CVE-2026-27905?

PyPI bentoml is affected in <1.4.36.

Is CVE-2026-27905 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

high

CVE-2026-27905

Q: Is CVE-2026-27905 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

PyPI · bentoml

Summary

BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

Severity: high
EPSS: 0.3% (p17)
Also known as: GHSA-m6w7-qv66-g3mf
Published: 2026-03-03

References

https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf
https://nvd.nist.gov/vuln/detail/CVE-2026-27905
https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670

Related advisories

CVE-2026-35044 — critical · PyPI/bentoml
CVE-2025-54381 — critical · PyPI/bentoml
CVE-2025-32375 — critical · PyPI/bentoml
CVE-2025-27520 — critical · PyPI/bentoml
CVE-2024-9070 — critical · PyPI/bentoml
CVE-2026-44346 — high · PyPI/bentoml
CVE-2026-44345 — high · PyPI/bentoml
CVE-2026-35043 — high · PyPI/bentoml

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.