VDB
GHSA-mrmq-3q62-6cc8
GHSA-mrmq-3q62-6cc8
PUBLISHED
CVSS 9.899999618530273 CRITICAL
BentoML SSRF Vulnerability in File Upload Processing
Record from GitHub Advisory Database · Published July 29, 2025
bentoml is fixed in 1.4.19 (PyPI)
BentoML SSRF Vulnerability in File Upload Processing
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| bentoml | PyPI | 1.4.19 |
Risk scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | bentoml | 1.4.0 |
| PyPI | bentoml | 1.4.0 |
Timeline
- Jul 29, 2025 CVE Published
- Mar 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-mrmq-3q62-6cc8
vulnetix vdb fixes GHSA-mrmq-3q62-6cc8Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-mrmq-3q62-6cc8/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8 url
- https://github.com/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-54381 vendor-advisory
- https://github.com/bentoml/BentoML product
- GitHub Advisory GHSA-mrmq-3q62-6cc8 vendor-advisory