CVE-2026-11816
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue during archive extraction. Validation functions compare archive member paths against the current working directory (CWD) instead of the actual extraction destination, which in environments like Docker, CI/CD, or Jupyter (where CWD is '/') allows bypassing security checks and writing files outside the intended directory.
Risk Assessment
An attacker can overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines, leading to system integrity compromise and potential application takeover.
Recommendation
Upgrade Keras to version 3.14.0 or later immediately. In environments where upgrade is not possible, avoid extracting archives from untrusted sources and consider setting CWD to a safe directory.
Original NVD description (English source)
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.