CVE-2025-54381 is a critical Server-Side Request Forgery (SSRF) vulnerability in BentoML's file upload processing system affecting versions >=1.4.0 <1.4.19. It allows unauthenticated remote attackers to make arbitrary HTTP requests from the server to internal network resources, cloud metadata endpoints, or localhost services due to insufficient validation of URLs in multipart form data and JSON request handlers. The vulnerability arises because the framework automatically treats file-type parameters as vulnerable endpoints, and the multipart handler lacks any URL validation. This can lead to credential theft, internal network reconnaissance, and potential exploitation of internal services. A fix is available in version 1.4.19.