CVE-2025-12060

Name of the Vulnerable Software and Affected Versions Keras versions prior to 3.12

Description The keras.utils.get file API is susceptible to a path traversal attack when the extract=True option is used for tar archives. The issue occurs because the extract archive() function calls Python's tarfile.extractall() without the filter="data" parameter. This allows a remote attacker to craft a malicious tar archive containing a deep symlink chain that exceeds the PATH MAX limit. When the system fails to resolve these excessively long symlink paths, it may treat them as literal paths, bypassing security filters and enabling the attacker to write arbitrary files to any location on the filesystem outside the intended destination folder. This behavior is linked to a weakness in the underlying Python tarfile module.

Recommendations Upgrade Keras to version 3.12 or later. As a temporary mitigation, avoid using the extract=True option in the keras.utils.get file API when processing untrusted tar archives.