CVE-2025-12638

The record

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.

Affected packages

Related vulnerabilities

• GHSA-9g7v-8wxv-mwxp Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal… Same vulnerability
• CVE-2026-1669 Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions… Also affects keras
• CVE-2026-0897 Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading… Also affects keras
• CVE-2025-12060 The keras.utils.get_file API in Keras, when used with the extract=True option for tar… Also affects keras
• CVE-2025-12058 The Keras.Model.load_model method, including when executed with the intended security… Also affects keras
• CVE-2024-55459 keras Path Traversal vulnerability Also affects keras
• CVE-2024-3660 A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows… Also affects keras
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22