Keras CVE-2025-12060

Exploitation requires a victim application to call keras.utils.get_file() with the non-default extract=True option on a tar archive whose source or contents are attacker-controlled; plain (non-extracted) downloads and zip archives via the same API are not the vector described. The bypass further depends on the underlying Python tarfile PATH_MAX symlink-resolution behavior (CVE-2025-4517), so it needs sufficiently long/crafted symlink paths to make failed resolution fall back to literal traversal paths. Limiting factors that reduce real-world risk: the victim must initiate the fetch/extraction of an attacker-influenced archive (user interaction), the target must still run Keras <= 3.11.3 (upgrading Python alone does NOT remediate - Keras 3.12.0 is required), and deployments that only extract trusted vendor datasets/models are not practically exposed.

The vendor CVSS 4.0 base score of 8.9 (AV:N/AC:L/AT:P/PR:L/UI:P) looks severe at first glance, but several signals temper the real-world urgency. The network vector (AV:N) reflects that the malicious tar is fetched remotely, yet exploitation is gated by two conditions the attacker does not fully control: a victim application must call keras.utils.get_file() with extract=True against attacker-influenced content (UI:P), and the bypass depends on the Python tarfile PATH_MAX symlink-resolution quirk inherited from CVE-2025-4517 (AT:P). No CISA KEV listing is present, so this is NOT confirmed actively exploited; no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. However, publicly available exploit code exists - the GHSA advisory (GHSA-hjqc-jx6g-rwp9) includes a Proof of Concept section with working code - which raises the practical risk above a theoretical path-traversal. Signals conflict on access: the vendor vector encodes PR:L (implying some privilege/authentication), but the actual gate is victim interaction plus an attacker-controlled archive, not authentication to the target - treat the 'authenticated' implication of PR:L with caution and verify against your deployment. No SSVC decision data (exploitation/automatable/technical-impact) was provided. Net: a genuine, high-impact arbitrary-file-write-to-RCE risk for ML pipelines that download and extract untrusted or user-supplied tar archives, but materially lower risk for deployments that only fetch from trusted, vendor-controlled sources.

An attacker hosts a specially crafted tar archive containing long-path symlinks and induces a victim ML application to retrieve it via keras.utils.get_file(url, extract=True). During extraction, tarfile.extractall() runs without filter="data" and the PATH_MAX symlink-resolution bug causes a traversal path to be written literally, placing attacker files (e.g. a malicious Python module, cron entry, or SSH authorized_keys) outside the intended directory and enabling code execution. A working Proof of Concept is published in the GHSA advisory; because the trigger relies on a normal library call and a symlink quirk, exploitation is realistic but requires the victim to extract attacker-controlled content.