PT-2025-44433 · Keras+1 · Keras+1

Krishna Gudimetla · Published 2025-10-30 · Updated 2025-11-28 · CVE-2025-12060

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Keras (affected versions not specified)

Description The keras.utils.get file API in Keras is susceptible to a path traversal issue when the extract=True option is used with tar archives. The utility employs Python’s tarfile.extractall function without utilizing the filter="data" feature. An attacker can create a malicious tar archive with specially crafted symlinks. Extracting this archive allows the attacker to write arbitrary files to locations outside the intended destination folder on the filesystem. This issue stems from a weakness in the underlying Python tarfile functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-69472

CVE-2025-12060

GHSA-28JP-44VH-Q42H

GHSA-HJQC-JX6G-RWP9

Affected Products

Debian

Keras

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2025-12060 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12060 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12060 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12060 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12060 · Security Note
• https://ubuntu.com/security/CVE-2025-12060 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12060 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69472 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28jp-44vh-q42h · Vendor Advisory
• https://github.com/keras-team/keras · Note
• https://github.com/keras-team/keras/commit/47fcb397ee4caffd5a75efd1fa3067559594e951 · Note
• https://github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9 · Note
• https://github.com/keras-team/keras/pull/21760 · Note
• https://reddit.com/r/VulnMatter/comments/1ol36t3/resumen_diario_de_vulnerabilidades_31102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1984009218706317498 · Twitter Post