CVE-2026-11816

Name of the Vulnerable Software and Affected Versions Keras versions prior to 3.14.0

Description A path traversal issue exists in the archive extraction utilities within keras/src/utils/file utils.py. The functions filter safe tarinfos() and filter safe zipinfos() validate archive member paths against the process current working directory (CWD) rather than the actual extraction destination. In environments where the CWD is set to /, such as Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass security checks. Additionally, the zip filter contains a bug that triggers an AttributeError when a blocked entry is encountered, resulting in incomplete extraction. Python 3.11 installations are further impacted as they lack the filter="data" safety net, relying solely on the flawed CWD-based filter. This can lead to arbitrary file writes outside the intended directory, potentially allowing the overwriting of configuration files, injection of malicious code, or corruption of machine learning datasets and pipelines.

Recommendations Update to version 3.14.0 or later.