CVE-2026-12479: Path Traversal in keras-team/keras
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (..). While forward slashes (/) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify DiskIOStore.make to validate layer names and reject or escape any that contain parent-directory sequences ('..') or other path traversal components before using them to construct filesystem paths. Ensure no layer name containing '..' is used to create directories or files.
keras-team/keras DiskIOStore.make reject_layer_names_with_parent_directory_components = true - Compensating control
Treat models from untrusted sources as untrusted code: perform all save/load operations for untrusted models inside an isolated sandbox or container with filesystem access limited to the intended temporary working directory (e.g., mount only a dedicated temp directory and deny writes elsewhere), and run with minimal filesystem privileges.
- Operational
Scan existing saved models and model definitions for layer names containing parent-directory sequences ('..'). For any found, remove or rename such layers or sanitize their names before loading or re-saving the model to prevent extraction to arbitrary filesystem locations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12479?
The severity of CVE-2026-12479 is rated as medium with a score of 6.1.
How do I fix CVE-2026-12479?
To fix CVE-2026-12479, update to a patched version of keras that resolves the path traversal issue.
What types of systems are affected by CVE-2026-12479?
CVE-2026-12479 affects systems using keras-team/keras version 3.14.0.
What is the risk associated with CVE-2026-12479?
The risk associated with CVE-2026-12479 includes potential unauthorized access to the filesystem due to path traversal.
What kind of vulnerability is CVE-2026-12479?
CVE-2026-12479 is a path traversal vulnerability that occurs due to improper handling of user-provided layer names.