CVE-2026-11816: Keras path traversal (CVSS 8.1)

Description

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeError` when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the `filter="data"` safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Keras< 3.14.0

Remediation

Fixed in

Keras≥ 3.14.0

Patch & vendor advisories

https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888

References

https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/security/cve/CVE-2026-11816MitigationThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487912Third Party Advisory
https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888Patch
https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4fExploitThird Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11816.jsonThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-11816 being actively exploited?

CVE-2026-11816 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.56%.

How severe is CVE-2026-11816?

CVE-2026-11816 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.56% probability of exploitation.

Which products are affected by CVE-2026-11816?

Affected products include Keras.

How do I fix CVE-2026-11816?

Upgrade affected software to a fixed version, for example Keras 3.14.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-11816 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo