CVE-2025-12638: Keras: Path Traversal enables file access

UNKNOWN CISA: ATTEND

Published November 28, 2025

CISO Take

Keras 3.11.3 has a path traversal vulnerability in get_file() that enables arbitrary file writes via crafted tar archives, bypassing the library's own safety filter through a PATH_MAX symlink resolution bug. Any ML training pipeline or data science environment that fetches external datasets or model weights using Keras is at risk of remote code execution. Patch immediately or restrict get_file() calls to verified internal artifact registries until patched.

What is the risk?

HIGH risk for organizations with automated ML pipelines that pull external artifacts. The PATH_MAX symlink bypass defeats Keras's built-in filter_safe_paths() check, making exploitation reliable and not dependent on a race condition. Attack surface is large because downloading pre-trained weights and public datasets via get_file() is a standard Keras workflow. If training runs as a privileged user or in a shared MLOps environment, the blast radius extends to lateral movement and full system compromise.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

6 steps

Upgrade Keras to the patched version (fix is adding filter='data' to tarfile.extractall()).
If patching is blocked, audit all calls to keras.utils.get_file() and restrict to downloads from internal, checksum-verified artifact registries only.
Run training workloads in isolated containers with read-only host mounts and least-privilege write permissions.
Enable filesystem integrity monitoring (Falco, AIDE) on training nodes — alert on writes outside ~/.keras/ cache during extraction.
Pin Keras versions explicitly in requirements files and verify checksums in your supply chain pipeline.
In CI/CD, sandbox model download steps away from sensitive mounts before extraction.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Framework Training Data AML.T0002.000 - Datasets AML.T0010.001 - AI Software AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0011.001 - Malicious Package AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity Article 15 - Accuracy, robustness, and cybersecurity

ISO 42001

A.10.1 - AI system technical security A.6.2.3 - AI supply chain risk management

NIST AI RMF

GOVERN-1.2 - Risk Tolerance and Prioritization MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems MANAGE-2.2 - Risk Treatment

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-12638?

Is CVE-2025-12638 actively exploited?

No confirmed active exploitation of CVE-2025-12638 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-12638?

1. Upgrade Keras to the patched version (fix is adding filter='data' to tarfile.extractall()). 2. If patching is blocked, audit all calls to keras.utils.get_file() and restrict to downloads from internal, checksum-verified artifact registries only. 3. Run training workloads in isolated containers with read-only host mounts and least-privilege write permissions. 4. Enable filesystem integrity monitoring (Falco, AIDE) on training nodes — alert on writes outside ~/.keras/ cache during extraction. 5. Pin Keras versions explicitly in requirements files and verify checksums in your supply chain pipeline. 6. In CI/CD, sandbox model download steps away from sensitive mounts before extraction.

What systems are affected by CVE-2025-12638?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, transfer learning workflows, MLOps CI/CD pipelines, data preprocessing pipelines, model serving.

What is the CVSS score for CVE-2025-12638?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinestransfer learning workflowsMLOps CI/CD pipelinesdata preprocessing pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0002.000 Datasets

AML.T0010.001 AI Software

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0011.001 Malicious Package

AML.T0018.002 Embed Malware

Compliance Controls Affected

EU AI Act: Art. 15, Article 15

ISO 42001: A.10.1, A.6.2.3

NIST AI RMF: GOVERN-1.2, MANAGE 2.2, MANAGE-2.2

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.

Exploitation Scenario

An adversary publishes a weaponized dataset or model weights archive to a public repository (HuggingFace, Kaggle, public S3). The archive contains a symlink chain crafted to exceed PATH_MAX during extraction. A victim's automated training pipeline calls keras.utils.get_file() — the standard pattern for fetching benchmarks or fine-tuning weights. Keras runs filter_safe_paths() pre-extraction, but the PATH_MAX bug causes symlink resolution to fail silently, bypassing the check. During tarfile.extractall(), files land at attacker-controlled paths: overwriting ~/.bashrc, SSH authorized_keys, cron jobs, or dropping a backdoor into a Python site-packages directory. In shared MLOps platforms where training jobs run on multi-tenant GPU clusters, this becomes a privilege escalation and lateral movement vector across tenant boundaries.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.