Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()

The vulnerability lies within the keras.utils.getfile() function, specifically in its use of tarfile.extractall() without the filter='data' parameter. While Keras attempts to filter potentially unsafe paths, a PATHMAX symlink resolution bug bypasses this filtering. This allows an attacker to craft a malicious tar archive containing symlinks that, when extracted, resolve to paths outside the intended extraction directory. Successful exploitation could allow an attacker to overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive data. The impact is amplified if the Keras application runs with elevated privileges.

Organizations and individuals utilizing Keras for machine learning model development and deployment are at risk. This includes those using Keras within data pipelines that process external data sources, particularly if those sources are not thoroughly vetted. Users relying on shared hosting environments or pre-built container images containing Keras are also potentially vulnerable.

• python / keras:

import os
import tarfile

def check_keras_vulnerability(tar_file_path):
    try:
        with tarfile.open(tar_file_path, 'r') as tar:
            tar.extractall()
        print("Extraction successful - potential vulnerability")
    except Exception as e:
        print(f"Extraction failed: {e}")

# Example usage (replace with a potentially malicious tar file)
check_keras_vulnerability('malicious.tar.gz')

• python / keras: Monitor Keras logs for unusual file creation or modification events, particularly in unexpected directories. Look for errors related to symlink resolution or path length limits. • generic web: If Keras is deployed in a web application, monitor web server access logs for requests that attempt to upload or process tar archives from untrusted sources.

1. 2025-11-28Disclosure

   disclosure

1. Reserviert2025-11-03
2. Veröffentlicht2025-11-28
3. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to a patched version of Keras that addresses this vulnerability. Until an upgrade is possible, consider implementing strict file system access controls to limit the impact of potential exploitation. Implement input validation on any user-provided data used in tar archive creation or extraction. Monitor file system activity for unexpected writes outside the intended directories. Consider using a Web Application Firewall (WAF) to filter potentially malicious tar archive uploads, although this is not a complete solution.