Skip to content
Fencer Vulns
high 8.0

CVE-2025-12638 json

Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()

published 2025-11-28 11 mo ago modified 2026-10-19 21 d ago also GHSA-9g7v-8wxv-mwxp , EUVD-2025-199871

cvss
8.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.

Patch / fix

  • keras Azure Linux 3.0 3.3.3-5

azure linux advisories AZL-71185

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-12638 updated cvss 7.6

keras: Path Traversal Vulnerability in keras

  • Red Hat OpenShift AI 2.16 rhoai 1774283191
    fixed: vendor fix RHSA-2026:5807
  • Red Hat OpenShift AI 2.25 rhoai v2.25.1-1764825096, rhoai v2.25.1-1764961121, rhoai v2.25.1-1765326513, rhoai v2.25.1-1765613316
    fixed: vendor fix RHSA-2025:23531
  • Red Hat OpenShift AI 3.3 rhoai 1770754585, rhoai 1770754605, rhoai 1770754646, rhoai 1771502844, rhoai 1771502884, rhoai 1771502897, +2 more
    fixed: vendor fix RHSA-2026:3713
  • Red Hat Trusted Artifact Signer 1.3 rhtas 1772614635
    fixed: vendor fix RHSA-2026:4271
  • Red Hat OpenShift AI 2.16 rhoai 1774282058, rhoai 1774282073, rhoai 1774282078, rhoai 1774282087, rhoai 1774282092, rhoai 1774282093, +18 more Red Hat OpenShift AI 2.25 rhoai 0.0-1763988459, rhoai v2.25.1-1764757768, rhoai v2.25.1-1764757769, rhoai v2.25.1-1764757770, rhoai v2.25.1-1764757772, rhoai v2.25.1-1764757773, +33 more Red Hat OpenShift AI 3.3 rhoai 1769162595, rhoai 1769436305, rhoai 1769519975, rhoai 1770277795, rhoai 1770735854, rhoai 1770788873, +64 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • keras-team keras-team/keras

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.