The vulnerability is a symlink traversal flaw in BentoML's build packaging workflow that allows an attacker to place a symbolic link in the build context pointing to a sensitive local file. When bentoml build dereferences the link, the file's contents are copied into the generated Bento artifact, exposing data that may include credentials, keys, or environment configurations. This flaw is identified as CWE‑59 and permits information disclosure rather than code execution or denial of service.

The issue affects BentoML version 1.4.38 and earlier. Versions 1.4.39 and later contain a fix. All installations of BentoML that build artifacts from untrusted or attacker‑controlled repositories are potentially vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. If an untrusted build context is processed, an attacker can exfiltrate local files from the build host. The compromised files can then be exported, pushed, or containerized, enabling further spread beyond the original machine. The primary attack vector is the ability to influence the build context contents, so protecting the build environment and ensuring only trusted sources are used are key to mitigation.