BentoML’s safe_extract_tarfile function is intended to prevent tar extraction from writing files outside the intended destination directory. The function validates only the symlink’s own path, not the target of the link. An attacker who can supply a malicious tar archive can create a symlink that points outside the extraction folder and a regular file that resolves through that symlink, causing an arbitrary file write on the host filesystem. This allows modification or creation of any file on the system where the extraction occurs, potentially compromising application code, configuration, or system binaries.

The vulnerability affects versions of BentoML older than 1.4.36. The issue is present in all installations that use the safe_extract_tarfile routine before the 1.4.36 release, regardless of deployment environment. Upgrading to version 1.4.36 or later applies the patch that fully validates symlink targets.

The CVSS score of 8.6 rates this as high severity, and the EPSS score of less than 1 % indicates that exploitation probability is low as of the current data set. The vulnerability is not listed in the CISA KEV catalog. If an attacker can control the content of a tar file that is extracted by BentoML, they can write an arbitrary file through a symlink, making the risk significant while the likelihood of exploitation remains modest. The attack requires the attacker’s input to the tar extraction process; no additional privileges are needed beyond the execution context of the extraction routine.