Path Traversal Vulnerability in Keras by TensorFlow
CVE-2025-12638

8HIGH

Key Information:

Vendor

Keras-team

Status
Keras-team/keras
Vendor
CVE Published:
28 November 2025

What is CVE-2025-12638?

Keras version 3.11.3 has a security flaw in its keras.utils.get_file() function related to path traversal during tar archive extraction. This vulnerability arises from the improper use of Python's tarfile.extractall() method, which does not implement a critical security filter. Although attempts are made to mitigate unsafe paths, a bug in symlink resolution may lead to files being written outside the intended cache directory. Such a scenario opens up avenues for unauthorized file writes, potentially compromising the system or allowing execution of malicious code.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

keras-team/keras <= unspecified

References

https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9ae...

CVSS V3.0

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.