CVE-2026-11816Path Traversal in keras-team/keras

Beschreibung

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f ExploitThird Party Advisory
• https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888 Patch
• https://access.redhat.com/errata/RHSA-2026:42644
• https://access.redhat.com/security/cve/CVE-2026-11816 MitigationThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487912 Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11816.json Third Party Advisory