Path Traversal Vulnerability in Keras by Keras Team
CVE-2025-12060

8.9HIGH

Key Information:

Vendor

Keras

Status
Keras
Vendor
CVE Published:
30 October 2025

What is CVE-2025-12060?

The Keras API's get_file function presents a security weakness when extracting tar archives with the extract=True option, enabling potential path traversal attacks. The vulnerability arises due to the use of Python's tarfile.extractall without proper filtering, allowing an attacker to design a malicious tar file that can create symlinks. This flaw can permit unauthorized file writing outside of the intended directories, compromising the filesystem's integrity. Users are advised to update to Keras version 3.12 to mitigate this risk and further secure their applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Keras 3.0.0 <= 3.11.3

References

https://github.com/keras-team/keras/pull/21760
https://github.com/keras-team/keras/security/advisories/G...

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krishna Gudimetla
JSON
.