CVE-2025-54381 in the critical feed json
BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
published 2025-07-29 15 mo ago modified 2026-10-27 12 d ago also EUVD-2025-23049 , GHSA-mrmq-3q62-6cc8 , PYSEC-2026-297
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.2%
- EPSS 13.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
13.18% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| OSV | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | bentoml | >=1.4.0, <1.4.19 |
1.4.19 |
Affected products
- bentoml BentoML
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8
web, patch
-
github.com
/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8
exploit, web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-54381
advisory
-
github.com
/bentoml/BentoML
package
-
github.com
/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2026-297.yaml
web
-
pypi.org
/project/bentoml
web, package
-
github.com
/advisories/GHSA-mrmq-3q62-6cc8
advisory
Sources
- CVE List CVE-2025-54381
- GitHub Advisory GHSA-mrmq-3q62-6cc8
- NVD CVE-2025-54381
- OSV PYSEC-2026-297
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.