Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`
Why It Matters
Analysis dossierWhy It Matters
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; Source severity; no confirmed exploitation signal
Affected Products & Remediation
1 source-backed product- keras keras · < 3.14.0 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched path-traversal (CWE-22); user-interaction-client (CVSS AV:N, CVSS UI:R)
Exposure
- Locate affected deployments and the path-handling endpoint named by the advisory.Telemetry: Application access logs · The affected path must come from the source, not the CWE alone. · Rule path-traversal
- Identify endpoints reporting this CVE, especially those used for email and web browsing.Telemetry: DeviceTvmSoftwareVulnerabilities · A network vector that needs user interaction points at user-facing client software. · Rule user-interaction-client
Exploitation evidence
- Review requests to that endpoint for traversal encodings and unusual file responses.Telemetry: Application access logs · Such patterns are a hypothesis to validate against normal traffic. · Rule path-traversal
Show more (2)
Exploitation evidence
- Review unusual child processes started by the affected client application on affected endpoints.Telemetry: DeviceProcessEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule user-interaction-client
Response
- Verify the source-stated fix and retest the affected path.Telemetry: Application change records · The exact remediation depends on the source advisory. · Rule path-traversal
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- security@huntr.dev
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-11816"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…