Keras: Keras archive extraction utilities allow path traversal and arbitrary file writes
Keras
More for Keras RSS feed for Keras
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Record
- CVE-2026-11816
- Affects
- Keras
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 11, 2026
- Source last modified
- October 26, 2026
Description
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/file_utils.py. The functions filter_safe_tarinfos() and filter_safe_zipinfos() validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to /, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an AttributeError when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the filter="data" safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.
Description quoted from the NVD record.
Who is affected
Keras is a toolkit that programmers use to build and train AI models. This flaw affects versions before 3.14.0, in the part that unpacks archive files (zip and tar files). When Keras runs from the top folder of a computer's file system, which is common in Docker containers, automated build and testing systems, and Jupyter notebook environments, a safety check can be bypassed. Installations on Python 3.11 rely entirely on that faulty check. An attacker who gets Keras to unpack a booby-trapped archive could write files outside the intended folder, overwriting settings files, planting harmful code, or corrupting data and AI pipelines. This flaw is rated High.
What to do
- Whoever installed or looks after software that uses Keras at your organization (often a developer, data scientist, or IT provider) should handle this.
- If you are not sure whether anything at your organization uses Keras, ask the people who build or run your AI and data projects.
- Update Keras to version
3.14.0or later everywhere it is installed, including Docker containers, automated build and testing systems, and Jupyter notebook environments. - If an IT provider or vendor runs these systems for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.