# BentoML has a Path Traversal via Bentofile Configuration

BentoML bentofile.yaml path fields accept absolute/traversal paths, letting a malicious repo embed victim files like /proc/self/environ into the built bento archive.

- Payout: Research
- Severity: high
- Program: BentoML
- Found by: logicx24
- Disclosed: 2026-01-26
- CVE: CVE-2026-24123
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6r62-w2q3-48hf
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-6r62-w2q3-48hf
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:python technique:source-review vuln:path-traversal vuln:secrets-leak

**Target:** bentofile.yaml build configuration / bentoml build CLI
**Root cause:** resolve_user_filepath() and the description handler resolve user-supplied paths with expanduser/expandvars/joinpath and realpath but never verify the result stays inside the build context directory.
**Steps:**
1. Create service.py with a minimal @bentoml.service class.
2. Write bentofile.yaml with `description: "file:/proc/self/environ"` (or `docker.dockerfile_template: "$HOME/.aws/credentials"`, `~/.ssh/id_rsa`, `../../../etc/passwd`).
3. Run `bentoml build`.
4. Read the built bento: `cat ~/bentoml/bentos/test_service/abc123/README.md | tr '\0' '\n'` to recover env secrets, or env/docker/Dockerfile.template for the docker fields.
**How found:** Code review of path resolution helpers: noticed resolve_user_filepath returns realpath without containment check, and description uses joinpath directly, then enumerated all config fields feeding file copies and the path formats each supports.
**Exploitation:** Attacker commits a malicious bentofile.yaml to a repo; victim runs bentoml build, which copies the targeted file into README.md or env/docker|conda artifacts inside the bento. Pushing/exporting the bento to a registry or BentoCloud uploads the stolen secrets to a channel the attacker can read.
**Escalation:** Chaining /proc/self/environ theft with CI/CD pipelines yields all injected secrets (AWS keys, GITHUB_TOKEN, DB creds) in one payload; pushing to BentoCloud turns the platform into an exfiltration channel visible to org members.
**Insight:** Build/packaging tools that copy user-referenced files into artifacts are a supply-chain exfil primitive: audit every config field that becomes a file copy, and test /proc/self/environ plus $VAR/~ expansion per field since handlers differ.

## Proof of concept (copied exactly from the original report)

**Malicious bentofile exfiltrating /etc/passwd via description**

```
service: "service.py:TestService"
description: "file:/etc/passwd"
```

**Bentofile exfiltrating env vars via /proc/self/environ**

```
service: "service.py:TestService"
description: "file:/proc/self/environ"
```

**Docker template path traversal to SSH key**

```
service: "service.py:TestService"
docker:
  dockerfile_template: "~/.ssh/id_rsa"
```