CVE-2026-27905

CVE-2026-27905 is a high-severity arbitrary file write vulnerability affecting BentoML versions prior to 1.4.36. An attacker can craft a malicious tar file containing a symlink that points outside the intended extraction directory, followed by a regular file that writes through this symlink, allowing for arbitrary file creation or modification on the host system. The CVSS score of 7.8 indicates a high impact, with a local attack vector and user interaction required, but low attack complexity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.