CVE-2026-11816: Path Traversal in keras-team/keras

Synopsis

A path traversal vulnerability in Keras (versions before 3.14.0) affects the archive extraction utilities in keras/src/utils/file_utils.py. The flaw is reachable over the network without authentication, but requires a victim to interact with a malicious archive, such as opening a crafted model or dataset file. Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory, overwriting configuration files, injecting malicious code, or corrupting ML datasets and pipelines. A patched-image rebuild at version 3.14.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious archive over the network, so the affected service or user must be reachable from the attacker's network position.

• AuthenticationNot required

  No credentials are needed; any unauthenticated party who can supply an archive to the target process can attempt exploitation.

• Victim interactionRequired

  A user or automated pipeline must open or extract the attacker-crafted archive file, making this a social-engineering or supply-chain delivery vector.

• Attack complexityDetail

  Exploit conditions are reliable and require no special race conditions or environmental tuning; any Keras environment running with CWD set to / (common in Docker, CI/CD, and Jupyter) is straightforwardly affected.

Blast Radius

• Attacker writes arbitrary files outside the intended extraction directory, overwriting configuration files such as credentials, service configs, or SSH authorized keys.
• Attacker injects malicious code into Python packages, startup scripts, or model definition files already present on the filesystem.
• Attacker corrupts or replaces ML datasets and pipeline artifacts, causing silent misbehavior in trained models or data preprocessing steps.
• Confidentiality and integrity of the host filesystem are both compromised; the CVSS vector rates both C and I as High with no availability impact.