BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.

Affected: PyPI: bentoml

### Summary

BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.

### Details

The vulnerability exists in how BentoML resolves user-provided file paths without validating that they remain within the build context directory.

**Vulnerable function** in `src/bentoml/_internal/utils/filesystem.py:114-131`:

```python def resolve_user_filepath(filepath: str, ctx: t.Optional[str]) -> str: _path = os.path.expanduser(os.path.expandvars(filepath)) if not os.path.isabs(_path) and ctx: _path = os.path.expanduser(os.path.join(ctx, filepath)) if os.path.exists(_path): return os.path.realpath(_path) # No path containment check raise FileNotFoundError(f"file {filepath} not found") ```

**Vulnerable code** in `src/bentoml/_internal/bento/bento.py:348-355`:

```python if build_config.description.startswith("file:"): file_name = build_config.description[5:].strip() if not ctx_path.joinpath(file_name).exists(): raise InvalidArgument(f"File {file_name} does not exist.")…

Affected: PyPI: bentoml

### Summary

BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.

### Details

The vulnerability exists in how BentoML resolves user-provided file paths without validating that they remain within the build context directory.

**Vulnerable function** in `src/bentoml/_internal/utils/filesystem.py:114-131`:

```python def resolve_user_filepath(filepath: str, ctx: t.Optional[str]) -> str: _path = os.path.expanduser(os.path.expandvars(filepath)) if not os.path.isabs(_path) and ctx: _path = os.path.expanduser(os.path.join(ctx, filepath)) if os.path.exists(_path): return os.path.realpath(_path) # No path containment check raise FileNotFoundError(f"file {filepath} not found") ```

**Vulnerable code** in `src/bentoml/_internal/bento/bento.py:348-355`:

```python if build_config.description.startswith("file:"): file_name = build_config.description[5:].strip() if not ctx_path.joinpath(file_name).exists(): raise InvalidArgument(f"File {file_name} does not exist.")…