CVE-2024-8982 - CVE House
Back to Database
Status published Medium CVE-2024-8982

Local File Inclusion in bentoml/openllm

Vulnerability Description

A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system's security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8982

Credits & Attribution

No credits recorded in the NVD database.

References

More from bentoml

View All →
CVE-2025-54381
BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
Critical 9.9
CVE-2025-32375
Insecure Deserialization leads to RCE in BentoML's runner server
Critical 9.8
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Critical 9.8
CVE-2024-9070
Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml
Critical 9.8
CVE-2024-9056
Denial of Service in bentoml/bentoml
High 7.5

Affected Vendor

Affected Software

bentoml/openllm
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-29

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.