Read the docs
TI-2026-10199 Aliases CVE-2026-11816GHSA-hqp4-2352-xf5r

Path Traversal in keras-team/keras

Priority HIGH 70CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed keras-team/keras (keras-team): 3.14.0keras (PyPI): 3.14.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
keras-teamkeras-team/kerasbefore 3.14.03.14.0Patch availableCNA
—keras (PyPI)before 3.14.03.14.0Patch availableGHSA-hqp4-2352-xf5r
  • keras-team/keras Vendorkeras-team Affected before 3.14.0 Fixed in 3.14.0 Patch available CNA
  • keras (PyPI) Vendor— Affected before 3.14.0 Fixed in 3.14.0 Patch available GHSA-hqp4-2352-xf5r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:*before 3.14.0Vulnerablekeras-team
  • cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions before 3.14.0 Vulnerable ·keras-team

Remediation

  • Fix · CNA keras-team/keras (keras-team) Fixed in 3.14.0
  • Fix · GHSA-hqp4-2352-xf5r keras (PyPI) Fixed in 3.14.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Not affected: 3 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11816
  2. 2026-10-03 Alias added: GHSA-hqp4-2352-xf5r
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Exploit 1

Patch 1

Advisory 4

Other 5

  • TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
  • TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
  • TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
  • TI-2025-01336 Arbitrary Code Execution via Crafted Keras Config for Model Loading CVSS 4.0HIGH 7.3
  • TI-2026-10716 Path Traversal via Symlink Name Validation Bypass in keras-team/keras CVSS 3.1MEDIUM 6.5
  • TI-2024-36840 An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine… CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences