Executive brief
Keras, a popular deep learning library, contains a vulnerability in its file-handling utility. An attacker can provide a specially crafted archive file that, when downloaded and processed by the library, writes files to unintended locations on the user's computer. This could allow an attacker to overwrite sensitive system files or configuration data, potentially compromising the integrity of the machine.
Technical details
A path traversal vulnerability exists in the `get_file` function within `keras/src/utils/file_utils.py` of Keras versions up to and including 3.7.0. The issue arises when the function downloads and extracts a crafted tar archive that contains filenames with path traversal sequences (e.g., ../). Because the extraction process does not sufficiently validate the destination paths, an attacker can achieve arbitrary file writes on the local filesystem. Exploitation requires a user to be tricked into downloading a malicious file via the affected function. As of the advisory date, no official patch has been confirmed in the provided documentation.
Affected products
- Keras Team keras <= 3.7.0
Timeline
- 2025-01-08: disclosed
- 2025-01-08: advisory
References
- https://github.com/keras-team/keras
- https://keras.io/
- https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
- https://github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py
- https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-121.yaml