Platform
python
Component
keras
Fixed in
3.11.4
3.12.0
Keras's keras.utils.get_file() function contains a Directory Traversal vulnerability stemming from the use of tarfile.extractall() without the filter="data" parameter. This allows malicious tar archives to bypass security checks and write files outside the intended extraction directory, potentially leading to arbitrary code execution or data compromise. The vulnerability affects Keras versions up to 3.9.2 and is resolved in version 3.12.0.
An attacker could craft a malicious tar archive containing specially crafted symlinks and file paths. When Keras attempts to extract this archive using keras.utils.get_file(), the tarfile.extractall() function, lacking the filter="data" parameter, will resolve these symlinks and write files to arbitrary locations on the system. This could allow an attacker to overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive data. The potential impact is significant, especially in environments where Keras is used to process untrusted data or deploy models.
This vulnerability is considered high probability due to the ease of crafting malicious tar archives and the widespread use of Keras in machine learning deployments. Public proof-of-concept exploits are likely to emerge, increasing the risk of exploitation. The vulnerability was publicly disclosed on 2025-12-02. No active exploitation campaigns have been confirmed as of this writing.
Exploit Status
EPSS
0.12% (31% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade Keras to version 3.12.0 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to restrict the extraction directory to a tightly controlled and isolated location. Additionally, carefully validate the source of any tar archives processed by Keras, ensuring they originate from trusted sources. Implement input validation to sanitize file paths and prevent the creation of symlinks that could lead to traversal attacks. After upgrade, confirm by attempting to extract a known malicious tar archive and verifying that it fails to write outside the designated extraction directory.
Update Keras to version 3.12 or higher. This update fixes the path traversal vulnerability when extracting tar files. Also ensure you have a version of Python that has addressed CVE-2025-4517 (e.g., Python 3.13.4 or higher).
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-12060 is a CRITICAL vulnerability in Keras allowing attackers to write files outside the intended extraction directory via malicious tar archives, potentially leading to code execution.
Yes, if you are using Keras versions 3.9.2 or earlier, you are vulnerable. Upgrade to 3.12.0 or later to resolve the issue.
Upgrade Keras to version 3.12.0 or later. As a temporary workaround, restrict the extraction directory and validate archive sources.
No active exploitation campaigns have been confirmed, but public proof-of-concept exploits are likely to emerge, increasing the risk.
Refer to the Keras project's official security advisories and release notes for detailed information and updates regarding CVE-2025-12060.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.