CVE-2026-11816: Keras Path Traversal in Archive Extraction (CVSS 8.1)

Technical summary

The vulnerability exists in `keras/src/utils/file_utils.py`, specifically in the `filter_safe_tarinfos()` and `filter_safe_zipinfos()` functions. These functions are intended to prevent directory traversal attacks during archive extraction by validating member paths. However, they validate against `os.getcwd()` rather than against the intended extraction destination directory. When the current working directory is `/` (common in containerized and CI/CD environments), the validation boundary becomes the root filesystem, rendering the check useless for paths that traverse outside `/`. Additionally, the ZIP file filter has a bug where an `AttributeError` is raised when encountering a blocked entry, causing extraction to fail before the flawed validation is even applied. Python 3.11 users face additional risk because the standard library's `filter="data"` parameter—which provides a secondary safety mechanism—is unavailable, leaving only the broken CWD-based validation in effect.

Business impact

Successful exploitation enables arbitrary file writes to the filesystem, with implications across multiple business functions. Attackers could overwrite configuration files to alter application behavior, inject malicious code into deployed models or training pipelines, corrupt machine learning datasets leading to model poisoning, or plant backdoors in production systems. For organizations using Keras in data science workflows, model serving, or automated ML training, this vulnerability directly threatens model integrity and operational security. The impact is elevated in multi-tenant environments or shared infrastructure where attacker-controlled input might be processed through vulnerable Keras extraction routines.

Affected systems

Keras versions prior to 3.14.0 are vulnerable. The risk profile varies by environment and Python version: Python 3.11+ users have some mitigation from the standard library's `filter="data"` parameter if Keras uses it, but Python 3.11 installations lack this safety net entirely. All versions are at risk in environments where the process CWD is `/`, including Docker containers, Kubernetes pods, serverless functions, CI/CD runners (GitHub Actions, GitLab CI), and Jupyter notebooks running in standard configurations. Organizations should verify their installed Keras version and deployment contexts.

Exploitability

The vulnerability requires user interaction (UI=R in the CVSS vector), meaning an attacker must trick a user or automated process into extracting an attacker-controlled archive using a vulnerable Keras function. No authentication is required (PR=N), and the attack is network-accessible (AV:N). The barrier to exploitation is low: an attacker crafts a malicious tar or zip file with path traversal sequences (e.g., `../../etc/passwd`) and delivers it to a target. If that target's application uses Keras to extract the archive, and if the process CWD happens to be `/`, the traversal succeeds. In automated environments (batch processing, model retraining pipelines), this interaction requirement may be satisfied without human involvement, increasing practical risk.

Remediation

Upgrade Keras to version 3.14.0 or later. This release corrects the path validation logic to check against the actual extraction destination rather than the process CWD, and fixes the ZIP filter bug. After patching, validation will correctly reject traversal paths regardless of where the process is running. There are no known workarounds for the CWD-based check itself; patching is the primary remediation. As a complementary measure, organizations should review archive handling workflows and consider additional controls such as extracting archives into isolated temporary directories with restricted permissions, validating archive contents before extraction, or using sandboxing for archive processing.

Patch guidance

Apply Keras version 3.14.0 or later. Most Python environments can update via pip with `pip install --upgrade keras>=3.14.0`. For containerized deployments, update the base image or requirements.txt to pin Keras to 3.14.0 or higher, then rebuild and redeploy containers. For offline or air-gapped environments, download the patched Keras wheel and install locally. Verify the upgrade by checking the installed version: `python -c 'import keras; print(keras.__version__)'` should return 3.14.0 or later. Test patched systems against archive extraction workflows used in production to ensure no regression.

Detection guidance

Monitor for suspicious archive extraction patterns: look for tar or zip files being processed by Keras with path components containing `../` or similar traversal sequences. Review access logs for unexpected file creation or modification outside normal application directories, particularly in system directories like `/etc`, `/tmp`, or configuration paths. In containerized environments, examine image build logs for archive extraction during layer creation. For runtime detection, instrument Keras archive functions or monitor filesystem calls (using auditd on Linux or similar tools) for write operations to unexpected directories. Python application logging can be enhanced to record archive filenames and extraction destinations. In development, code review should flag any use of `keras.utils.get_file()` or direct calls to `filter_safe_tarinfos`/`filter_safe_zipinfos()` without explicit destination validation.

Why prioritize this

This vulnerability warrants high priority due to its CVSS 8.1 score, the prevalence of Keras in machine learning infrastructure, and the widespread use of containerized deployments where the exploitation condition (CWD=/`) is default. The attack surface includes automated training pipelines, model distribution systems, and data processing workflows that may process untrusted archives. The impact spans confidentiality and integrity. While exploitation requires user interaction, many modern ML platforms execute extraction routines automatically as part of data loading or model deployment. The fix is straightforward and low-risk, making remediation feasible at scale.

Risk score, explained

Keras is assigned CVSS 3.1 score 8.1 (HIGH) reflecting: attack vector Network (AV:N), allowing remote delivery of malicious archives; attack complexity Low (AC:L), as crafting a traversal-containing archive is trivial; privileges required None (PR:N); user interaction Required (UI:R), necessitating that a process extracts the attacker's archive; scope Unchanged (S:U); confidentiality impact High (C:H), as arbitrary file writes can read sensitive files or extract data; and integrity impact High (I:H), as files can be overwritten or injected. Availability impact is None (A:N) as the vulnerability does not directly disable services, though corrupted files could indirectly cause outages. The score reflects the combination of broad network reach, ease of exploitation, and dual impact on confidentiality and integrity, but is tempered by the user interaction requirement.

Frequently asked questions