Path Traversal in keras-team/keras
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (`..`). While forward slashes (`/`) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| keras-team | keras-team/keras | up to latest | — | No fix listed | CNA |
| — | keras (PyPI) | before 3.12.3 | 3.12.3 | Patch available | GHSA-gh82-f9x8-5frx |
| — | keras (PyPI) | 3.13.0 to before 3.15.0 | 3.15.0 | Patch available | GHSA-gh82-f9x8-5frx |
- keras-team/keras Vendorkeras-team Affected up to latest Fixed in — No fix listed CNA
- keras (PyPI) Vendor— Affected before 3.12.3 Fixed in 3.12.3 Patch available GHSA-gh82-f9x8-5frx
- keras (PyPI) Vendor— Affected 3.13.0 to before 3.15.0 Fixed in 3.15.0 Patch available GHSA-gh82-f9x8-5frx
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* | — | — | keras-team |
- cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions — — ·keras-team
Remediation
- Fix · GHSA-gh82-f9x8-5frx keras (PyPI) Fixed in 3.12.3 Advisory →
- Fix · GHSA-gh82-f9x8-5frx keras (PyPI) Fixed in 3.15.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12479
- 2026-10-03 Alias added: GHSA-gh82-f9x8-5frx
References
Other 6
- https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743
- https://github.com/keras-team/keras/pull/23017
- https://github.com/keras-team/keras/commit/d8caeb58cc9e61ea092445dc7a20908ca8d693e2
- https://github.com/keras-team/keras
- https://github.com/keras-team/keras/releases/tag/v3.12.3
- https://github.com/keras-team/keras/releases/tag/v3.15.0
More keras-team vulnerabilities
- TI-2025-31626 Deserialization of untrusted data in keras-team Keras CVSS 3.1CRITICAL 9.8
- TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
- TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
- TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
- TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
- TI-2025-11591 Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file() CVSS 3.0HIGH 8.0
Sources
- CVE-2026-12479 · CVE Program
- CVE-2026-12479 · NVD
- FIRST EPSS
- GHSA-gh82-f9x8-5frx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-12479 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences