PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11816 keras-team CVE debrief

A path traversal vulnerability was discovered in the archive extraction utilities of Keras, specifically in the `filter_safe_tarinfos()` and `filter_safe_zipinfos()` functions located in `keras/src/utils/file_utils.py`. These functions validate archive member paths against the process's current working directory (CWD) instead of the actual extraction destination. This can be exploited when the process runs with the CWD set to `/`, a common scenario in Docker containers, CI/CD runners, and Jupyter environments, effectively making the validation boundary the filesystem root. Consequently, traversal paths can bypass the security check. Additionally, there's a bug in the zip filter that causes an `AttributeError` when encountering a blocked entry, leading to incomplete extraction. Python 3.11 installations are particularly vulnerable as they lack the `filter='data'` safety net, making them entirely dependent on the flawed CWD-based filter. Successful exploitation can lead to arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Vendor
keras-team
Product
keras-team/keras
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-07-21
Advisory published
2026-06-11
Advisory updated
2026-07-21

Who should care

Users of Keras versions prior to 3.14.0, especially those running in environments like Docker containers, CI/CD runners, or Jupyter environments, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by the insecure path validation in `filter_safe_tarinfos()` and `filter_safe_zipinfos()`. The functions do not correctly validate archive member paths against the extraction destination, allowing for path traversal attacks.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Keras version 3.14.0 or later.
  • Ensure that the CWD is properly set and validated before running archive extraction utilities.
  • Use additional security measures, such as running the extraction utilities in a sandboxed environment.

Evidence notes

The vulnerability was reported by security researchers at Huntr. The CVE record and NVD details provide additional information on the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11816 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11816

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11816 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11816

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.