CVE-2026-12479: Keras 3.14.0 Path Traversal in Model Serialization

Technical summary

CVE-2026-12479 is a path traversal vulnerability in the `DiskIOStore.make` method of Keras 3.14.0. The vulnerability stems from insufficient sanitization of user-supplied layer names used in file system path construction. Although forward slash characters are filtered, parent directory traversal sequences (`..`) are not stripped before paths are created. This allows an attacker to craft a model with malicious layer names that escape the temporary working directory sandbox during model serialization or deserialization, potentially writing arbitrary files or creating directories in unintended locations.

Business impact

Organizations using Keras 3.14.0 for machine learning workflows face file system integrity risks. An attacker could leverage this to inject malicious files into system locations, overwrite critical configuration files, or stage follow-on attacks. The attack requires user interaction—an employee must load or save a compromised model—making social engineering or supply chain compromise vectors relevant. For teams managing shared model repositories or accepting external models, this represents a potential integrity and confidentiality concern.

Affected systems

Keras 3.14.0 is confirmed affected. The vulnerability is specific to the `DiskIOStore.make` method in Keras 3's persistence layer. Users should verify whether other minor versions in the 3.x line contain the same code path. Earlier Keras 2.x versions and other machine learning frameworks are not affected by this specific flaw, though similar path traversal patterns should be audited across comparable serialization libraries.

Exploitability

Exploitability is moderate. An attacker must author a malicious Keras model with crafted layer names containing directory traversal sequences and convince a user to load or save it. No network interaction is required; the attack is local and synchronous with model I/O. The CVSS 3.0 score of 6.1 (MEDIUM, AV:L/AC:L/PR:N/UI:R) reflects these constraints: local access, low complexity, no privilege requirement, but required user interaction. This is not a remote code execution vector and does not grant elevated privileges by itself.

Remediation

Update Keras to a patched version that properly sanitizes layer names by removing or escaping parent directory traversal sequences. Patch details and version numbers should be verified against the official Keras security advisory and GitHub releases. In interim, restrict model loading to trusted sources, implement file system access controls to limit the blast radius of unauthorized writes, and audit model repositories for suspicious layer names containing `..` patterns.

Patch guidance

Check the Keras GitHub repository and official security advisories for the specific patched version. The fix should sanitize layer name input by either stripping traversal components or validating that constructed paths remain within the intended directory. After patching, verify your Keras version and test model save/load operations with existing pipelines. If internal model repositories exist, consider scanning stored models for suspicious layer name patterns as a precaution.

Detection guidance

Monitor file system access patterns during Keras model I/O operations, particularly unexpected writes outside the designated temporary working directory. Review Keras model files (inspect `.h5` or custom serialization formats) for layer names containing `..` sequences. Implement file integrity monitoring on critical system directories and configuration paths. Log all model loading and saving events with user context to identify potentially malicious activity.

Why prioritize this

Although scoring as MEDIUM severity, prioritize this based on your ML pipeline exposure: if your organization accepts external models, loads community-shared models, or runs collaborative ML workflows, this vulnerability should be addressed promptly. The barrier to exploitation is low (craft a model with traversal sequences), and the impact spans file system integrity. Conversely, teams that only work with internally developed, closely controlled models may defer patching with compensating controls in place.

Risk score, explained

The CVSS 3.0 score of 6.1 reflects a local attack vector, low attack complexity, and no privilege requirement, balanced against the requirement for user interaction. The vulnerability does not directly enable code execution or confidentiality breaches of stored data, but can compromise file system integrity and enable staging attacks. The score appropriately captures the practical risk for development and deployment environments where model handling is routine.

Frequently asked questions