CVE-2025-12060 Overview
CVE-2025-12060 is a path traversal vulnerability [CWE-22] in the keras.utils.get_file API. When the function is called with extract=True on a tar archive, it invokes Python's tarfile.extractall without the filter="data" safeguard. A remote attacker can craft a malicious tar archive containing symbolic links that, upon extraction, write arbitrary files outside the intended destination directory. The flaw is linked to the underlying Python tarfile weakness tracked as CVE-2025-4517. Upgrading Python alone does not remediate the issue. Users must upgrade Keras to version 3.12 to receive the fix.
Critical Impact
Attackers can write arbitrary files anywhere on the filesystem accessible to the Keras process, enabling code execution, configuration tampering, and persistence on machine learning training and inference hosts.
Affected Products
- Keras versions prior to 3.12 using keras.utils.get_file with extract=True
- Python runtimes vulnerable to CVE-2025-4517 (pre-3.13.4 and unpatched earlier branches)
- Machine learning pipelines that fetch tar-packaged datasets or model weights via Keras utilities
Discovery Timeline
- 2025-10-30 - CVE-2025-12060 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12060
Vulnerability Analysis
The keras.utils.get_file helper downloads a remote file and optionally extracts it. When extract=True is passed and the archive is a tar file, Keras delegates extraction to Python's tarfile.extractall. Starting with PEP 706, tarfile exposes a filter parameter that rejects unsafe members such as absolute paths and symlinks that escape the destination directory. Keras does not pass filter="data", so the legacy permissive behavior is used.
This lets a malicious archive include a symlink pointing outside the extraction root, followed by a regular file written through that symlink. The result is an arbitrary file write at attacker-chosen paths with the privileges of the Keras process. In ML environments these processes often run with elevated access to credentials, model registries, and GPU hosts.
Root Cause
The root cause is the absence of filter="data" (or equivalent member validation) on the call to tarfile.extractall. The Python-level fix for CVE-2025-4517 defaults the filter to a safer mode, but Keras explicitly invokes extraction in a way that overrides or predates that default. Both the runtime and the library must be patched.
Attack Vector
Exploitation requires the victim to call keras.utils.get_file(..., extract=True) against an attacker-controlled URL or a tar archive whose contents the attacker influences. Common scenarios include tutorials, notebooks, or pipelines that pull datasets and pretrained weights from third-party hosts. After download, the crafted symlink members cause writes to paths such as ~/.ssh/authorized_keys, Python site-packages, or cron and systemd unit directories.
No authentication to the victim host is required for the attacker, and exploitation completes during normal extraction with no separate execution step. See the Keras Security Advisory GHSA-hjqc-jx6g-rwp9 for the upstream description.
Detection Methods for CVE-2025-12060
Indicators of Compromise
- Files written outside the Keras cache directory (default ~/.keras/) shortly after a get_file call, especially in ~/.ssh/, ~/.config/, or Python site-packages paths.
- Tar archives whose members resolve to absolute paths or contain symlinks targeting .. sequences or absolute system paths.
- Unexpected modifications to shell profile files, cron entries, or startup scripts on ML training nodes.
Detection Strategies
- Statically scan Python code and notebooks for keras.utils.get_file(...) invocations using extract=True against non-trusted URLs.
- Inspect tar archives prior to extraction with tar -tvf and reject entries containing .., absolute paths, or symlinks resolving outside the extraction root.
- Hook or audit tarfile.extractall calls in instrumented environments and flag any invocation without an explicit safe filter argument.
Monitoring Recommendations
- Monitor file creation events from Python interpreter processes that write outside designated data and cache directories.
- Alert on outbound network requests from training nodes to unapproved domains followed by extraction activity.
- Track installed Keras versions across hosts and notebooks and flag any version earlier than 3.12.
How to Mitigate CVE-2025-12060
Immediate Actions Required
- Upgrade Keras to version 3.12 or later on all systems that use keras.utils.get_file.
- Upgrade Python to a release containing the fix for CVE-2025-4517, such as 3.13.4, in addition to upgrading Keras.
- Audit recent pipelines that downloaded and extracted tar archives via Keras and verify integrity of the affected hosts.
Patch Information
The fix is delivered in Keras 3.12 and is implemented in GitHub Pull Request #21760, which passes filter="data" to tarfile.extractall. Refer to GitHub Security Advisory GHSA-hjqc-jx6g-rwp9 for vendor guidance.
Workarounds
- Avoid calling keras.utils.get_file with extract=True on tar archives from untrusted sources until both Keras and Python are patched.
- Download archives separately and extract them manually using tarfile.extractall(path, filter="data") or a vetted extraction routine.
- Run training and inference processes under least-privilege accounts with restricted write access to home directories and system paths.
# Configuration example
pip install --upgrade "keras>=3.12"
python -c "import keras, sys; sys.exit(0 if tuple(map(int, keras.__version__.split('.')[:2])) >= (3,12) else 1)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
