CVE-2026-11816

Description

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Traduire en français

Produits concernés

• keras-team/keras
• Red Hat OpenShift AI 2.25
• Red Hat OpenShift AI (RHOAI)
• Keras keras

Scores CVSS

Faiblesses (CWE)

• CWE-22

Références

• https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888 Patch
• https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f ExploitThird Party Advisory
• https://access.redhat.com/errata/RHSA-2026:42644
• https://access.redhat.com/security/cve/CVE-2026-11816 MitigationThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487912 Third Party Advisory
• https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f ExploitThird Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11816.json Third Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories