CVE-2026-12479Medium· 6.1▾ SunlitKeras: DiskIOStore permits path traversal through crafted layer names
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (..). While forward slashes (/) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.
keras < 3.12.3keras >= 3.13.0, < 3.15.0Upgrade to a patched release:
keras 3.12.3keras 3.15.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12484High· 7.8Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
CVE-2026-12482Low· 3.1Keras: tar extraction permits symlink-based path traversal
CVE-2026-12480Medium· 5.5Keras: HDF5 virtual datasets can disclose local files
CVE-2026-12570Medium· 5.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function
CVE-2024-55459Mediumkeras Path Traversal vulnerability
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality