CVE-2025-32375

CRITICAL

BentoML < 1.4.8 - Remote Code Execution via Insecure Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2025-32375. PoCs published by theGEBIRGE, SevdaKhidirova, surajpandeyp, including Metasploit module exploits/linux/http/bentoml_runner_server_rce_cve_2025_32375.

AI-analyzed exploit summary This PoC exploits a deserialization vulnerability in BentoML to achieve remote code execution (RCE) via a malicious pickle payload. The exploit sends a crafted HTTP request with a pickled object that triggers arbitrary command execution.

Description

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.

Exploits (4)

nomisec WORKING POC 3 stars
by theGEBIRGE · poc
https://github.com/theGEBIRGE/CVE-2025-32375

This PoC exploits a deserialization vulnerability in BentoML to achieve remote code execution (RCE) via a malicious pickle payload. The exploit sends a crafted HTTP request with a pickled object that triggers arbitrary command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: BentoML (version not specified)
No auth needed
Prerequisites: Network access to the target service · BentoML service running with vulnerable configuration
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by SevdaKhidirova · pythonpoc
https://github.com/SevdaKhidirova/CVE-2025-32375-PoC

This PoC exploits an insecure deserialization vulnerability (CVE-2025-32375) in BentoML's API endpoint by sending a malicious pickled payload via crafted HTTP headers. The payload triggers remote command execution (RCE) via Python's __reduce__ method during deserialization.

Classification
Working Poc 98%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Reliable
Target: BentoML (versions affected by GHSA-7v4r-c989-xh26)
No auth needed
Prerequisites: Network access to the vulnerable BentoML API endpoint (port 3000) · Target must deserialize attacker-controlled pickled data without validation
mistral-large-3 · analyzed Aug 05, 2026 Full analysis →
github WORKING POC
by surajpandeyp · htmlpoc
https://github.com/surajpandeyp/CVE-2025-32375

This repository demonstrates a Python pickle deserialization vulnerability (CVE-2025-32375) in a Flask-based ML prediction service. The exploit uses a crafted pickle payload to achieve remote code execution via unsafe deserialization in the `/api/v1/predict` endpoint.

Classification
Working Poc 98%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Reliable
Target: BentoML (v1.4.6, vulnerable version)
No auth needed
Prerequisites: Network access to the vulnerable Flask endpoint (`/api/v1/predict`) · Target must use Python's `pickle.loads()` on untrusted input
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by SeaWind, Takahiro Yokoyama · rubypocpython
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/bentoml_runner_server_rce_cve_2025_32375.rb

This Metasploit module exploits an insecure deserialization vulnerability in BentoML's runner server prior to version 1.4.8. It allows remote code execution by sending a crafted POST request with specific headers and a serialized payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: BentoML runner server < 1.4.8
No auth needed
Prerequisites: Network access to the target server · Target server running a vulnerable version of BentoML
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.5045
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
bentoml/bentoml 1.0.0 - 1.4.8
pypi/bentoml 1.0.0a1 - 1.4.8PyPI
Published Apr 09, 2025
Tracked Since Feb 18, 2026