CVE-2026-12479: Keras Path Traversal Vulnerability

CVE-2026-12479 Overview

CVE-2026-12479 is a path traversal vulnerability [CWE-22] in keras-team/keras version 3.14.0. The flaw resides in the DiskIOStore.make method within the Keras 3 model saving and loading library. User-provided layer names are used to construct directory paths without sanitizing parent directory traversal sequences (..). While forward slashes are restricted in layer names, directory traversal sequences are not. An attacker can craft a malicious Keras model that escapes the intended temporary working directory when saved or loaded, performing unauthorized file system operations such as creating directories or writing files in arbitrary locations.

Critical Impact
Loading a crafted Keras model can write files outside the intended directory, enabling potential code execution paths through arbitrary file writes on the host.

Affected Products

keras-team/keras version 3.14.0
Keras 3 model saving and loading library (DiskIOStore component)
Applications consuming untrusted Keras models for training, inference, or fine-tuning

Discovery Timeline

2026-06-22 - CVE-2026-12479 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12479

Vulnerability Analysis

The vulnerability is a classic path traversal weakness mapped to [CWE-22]. The DiskIOStore.make method in Keras 3 builds filesystem paths by concatenating a temporary working directory with layer names taken from a model archive. The implementation rejects forward slashes inside layer names but does not reject .. sequences. As a result, a layer named ..\target or ..//target on systems where alternative separators are interpreted resolves outside the intended sandbox directory.

Keras model archives are commonly distributed through public repositories such as Hugging Face and Kaggle. Users routinely download and load these models without inspecting their internal structure, which makes the attack surface broad in machine learning pipelines and inference services.

Root Cause

The root cause is insufficient input validation on layer name strings used as path components. The sanitization logic blocks one separator character but does not normalize the resulting path or verify that it remains within the intended base directory. A canonicalization check comparing the resolved path against the base directory would prevent the escape.

Attack Vector

Exploitation requires user interaction: a victim must save or load a malicious Keras model. The attacker constructs a model where one or more layer names contain traversal sequences. When DiskIOStore.make processes the archive, it creates directories or writes serialized layer data to attacker-controlled paths on the local filesystem. The scope is changed because files can be written outside the application sandbox, potentially overwriting configuration files or seeding code in directories that are later executed.

Reproduction details are documented in the Huntr Bounty Report.

Detection Methods for CVE-2026-12479

Indicators of Compromise

Keras model files (.keras, .zip archives) containing layer name entries with .., ..\, or encoded traversal sequences
Unexpected directory creation or file writes outside the process working directory during model load operations
Python processes invoking keras.saving.load_model followed by filesystem writes to sensitive paths

Detection Strategies

Inspect Keras archive metadata before loading and reject any layer name containing .. or path separator characters
Monitor Python interpreter processes for file write operations that resolve outside the application temp directory
Audit ML pipeline logs for model loads sourced from untrusted registries or user uploads

Monitoring Recommendations

Enable filesystem auditing on directories used by ML training and inference services
Alert on writes from Python processes to system configuration directories, startup folders, or user profile paths
Track Keras package versions across hosts and flag installations of version 3.14.0

How to Mitigate CVE-2026-12479

Immediate Actions Required

Identify all hosts and containers running keras 3.14.0 and prioritize upgrade to a patched release
Treat all Keras model files from external sources as untrusted input until validated
Run model loading operations inside containers or sandboxes with read-only and restricted filesystem mounts

Patch Information

Review the Huntr Bounty Report for vendor remediation guidance and upgrade to a Keras release that sanitizes layer names against directory traversal sequences in DiskIOStore.make.

Workarounds

Pre-scan Keras archives and reject entries whose layer names contain .. or backslash characters before invoking the loader
Execute model deserialization under a low-privilege user account with no write access outside a dedicated working directory
Apply mandatory access controls (AppArmor, SELinux, or seccomp profiles) to confine the Python process filesystem scope

bash

# Configuration example: validate Keras archives before loading
python - <<'EOF'
import zipfile, sys
with zipfile.ZipFile(sys.argv[1]) as zf:
    for name in zf.namelist():
        if '..' in name.split('/') or '..' in name.split('\\'):
            sys.exit(f'Reject: traversal in {name}')
print('Archive layer names validated')
EOF