Vulnerability · Published Jun 11, 2026 · Assigned by @huntr_ai
CVE-2026-11816Path Traversal in keras-team/keras
High 8.1
In plain English
A high-severity path traversal in keras-team/keras from keras-team. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | keras | 3.14.0 | GHSA-hqp4-2352-xf5r |
| PyPI | keras | 3.14.0 | PYSEC-2026-2324 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| keras-team | keras-team/keras | unspecified – before 3.14.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f
- https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888
- https://access.redhat.com/security/cve/CVE-2026-11816 vdb-entry, x_refsource_REDHAT
- RHBZ#2487912 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11816.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisory, x_refsource_REDHAT