GHSA-9g7v-8wxv-mwxp
High · 8.0CVSS
8.0
EPSS
—
Published
Nov 28, 2025
CISA due date
—
The record
Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | keras | 0 | 3.12.0 |
Related vulnerabilities
- CVE-2025-12638 Keras version 3.11.3 is affected by a path traversal vulnerability in the… Same vulnerability
- CVE-2026-1669 Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions… Also affects keras
- CVE-2026-0897 Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading… Also affects keras
- CVE-2025-12060 The keras.utils.get_file API in Keras, when used with the extract=True option for tar… Also affects keras
- CVE-2025-12058 The Keras.Model.load_model method, including when executed with the intended security… Also affects keras
- CVE-2024-55459 keras Path Traversal vulnerability Also affects keras
- CVE-2024-3660 A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows… Also affects keras
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22