CVE-2025-12638: Path Traversal in Keras

The vulnerability allows an attacker to leverage symlink resolution to bypass intended file access restrictions. Specifically, the tarfile.extractall() function is called without the filter='data' parameter, which is crucial for preventing malicious files from being extracted. While Keras attempts to filter unsafe paths, this filtering occurs before extraction, and the PATH_MAX symlink resolution bug circumvents this protection. This enables an attacker to write arbitrary files to locations outside the designated extraction directory, potentially overwriting critical system files or injecting malicious code. The blast radius extends to any system where Keras is deployed and processing untrusted tar archives.

1. Reserved2025-11-03
2. Published2025-11-28
3. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of Keras that addresses this vulnerability. The vendor has not yet released a specific fixed version, so monitor Keras's official channels for updates. As a temporary workaround, avoid processing untrusted tar archives with Keras. If processing is unavoidable, implement strict file system access controls to limit the potential impact of a successful exploit. Consider using a sandboxed environment to isolate Keras processes from sensitive system resources. After upgrading, verify the fix by attempting to extract a malicious tar archive containing a symlink designed to write outside the intended directory; the extraction should fail with an appropriate error.