What is the CVSS score of CVE-2026-11816?

CVE-2026-11816 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-11816?

Within 24 hours: Audit all systems running Keras to identify versions in use and which applications load model archives. Within 7 days: Deploy Keras 3.14.0 or later to staging environments and validate model loading workflows. Within 30 days: Complete production rollout across all systems and implement strict validation on external model sources.

Keras CVE-2026-11816

Q: Which versions of Keras are affected by CVE-2026-11816?

Keras versions prior to 3.14.0 contain a path traversal vulnerability allowing remote attackers to write arbitrary files outside the intended extraction directory when processing malicious model…. A patch is available.

EUVD-2026-36244 HIGH

Path Traversal (CWE-22)

2026-06-11 security@huntr.dev

GHSA-hqp4-2352-xf5r

Python Docker Path Traversal Keras

8.1

CVSS 3.1 · Vendor: huntr

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Host malicious .keras/.h5 archive
Delivery

Victim loads model in containerized pipeline
Exploit

CWD-based filter validates against `/`
Install

Traversal entries pass safety check
C2

Files written outside extraction dir
Execute

Overwrite config or inject code
Impact

Pipeline executes attacker payload

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Victim must invoke Keras archive extraction (e.g., `load_model`) on an attacker-controlled archive - this is the UI:R requirement. The vulnerable CWD-based check is effectively bypassed only when the process CWD resolves such that traversal still lands inside it, which the description identifies as CWD set to `/` (common in Docker containers, CI/CD runners, and Jupyter environments); on a workstation with CWD inside a project directory, the existing check still blocks most traversal. Impact is maximized on Python 3.11 (no tarfile `filter="data"` safety net) and reduced on Python 3.12+. No authentication is required on the Keras side, but real-world exploitation depends on the attacker getting the malicious archive in front of the victim's loader.
Impact	The provided CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1) reasonably reflects that the attack requires a victim to load a malicious archive (UI:R) but otherwise needs no privileges. There is no KEV listing, no EPSS score supplied, and no public POC evidence in the references - only a Huntr bounty page and the upstream fix commit - so this is best treated as a credible-but-not-yet-exploited supply-chain risk to ML workloads rather than an active emergency. The C:H/I:H rating is consistent with arbitrary file writes that can clobber config or inject code, but the A:N (no availability impact) is debatable since corrupting pipeline files could degrade availability; defenders should not over-rely on that single metric.
Exploit ScenarioDerived	An attacker publishes a malicious Keras model file (a crafted zip/tar archive) on a model hub, Hugging Face mirror, or shared S3 bucket containing entries with `../../../` traversal sequences pointing to paths like `/root/.ssh/authorized_keys` or `/etc/cron.d/`. A data scientist or CI job calls `keras.models.load_model()` on the archive inside a Docker container running as root with CWD `/`, and the extraction silently writes the attacker's payload outside the intended directory. No public POC was identified, but the Huntr report and the explicit code diff make weaponization straightforward.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 11, 2026

Path traversal in Keras archive extraction utilities prior to version 3.14.0 allows remote attackers to write files outside the intended extraction directory when a victim loads a malicious model archive. The flaw stems from validating archive member paths against the process current working directory rather than the actual extraction destination, which collapses to the filesystem root in common Docker, CI/CD, and Jupyter setups. No public exploit identified at time of analysis, but the upstream fix and a Huntr bounty disclosure make targeted exploitation against ML pipelines plausible.

RemediationAI

Upgrade Keras to 3.14.0 or later, which reworks filter_safe_zipinfos() and filter_safe_tarinfos() to take the actual extraction path as base_dir (see commit 2465b6657b02c8eed308759b7e800e295ae01888); released patched version not independently confirmed beyond the description's '3.14.0' string, so verify the tagged release before pinning. As compensating controls until you can upgrade, avoid calling extract_open_archive or loading .keras/.h5 archives from untrusted sources, run training/inference workers with a non-root CWD inside an unprivileged directory (e.g. WORKDIR /workspace in Docker) so the flawed CWD check still rejects most traversals, and prefer Python 3.12+ where tarfile's filter="data" provides a second line of defense - note this changes container ergonomics and may break scripts that assume CWD /. Reference the Huntr bounty page (https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f) for disclosure details.

Affected VersionsENISA

keras-team/keras unspecified <3.14.0

Affected Packages

pypi keras fix: 3.14.0

euvd keras_team_keras_unspecified fix: 3.14.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in pypi, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in filter_safe_zipinfos() and filter_safe_tarinfos() inside keras/src/utils/file_utils.py, which previously hardcoded base_dir = resolve_path(".") instead of receiving the real extraction path. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) realized through an incorrect trust boundary: traversal segments like ../ are compared against CWD, so when CWD is / (typical for containerized Python runtimes), any path stays 'within' the boundary. Compounding factors include an AttributeError bug in the zip filter that aborts iteration on a blocked entry and the absence of Python 3.11's filter="data" tarfile safety net, which is the upstream interpreter mitigation for PEP 706-style tar extraction hardening.

Know when Keras gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (huntr) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI 7.6 HIGH

Network-delivered malicious archive, no privileges, requires victim to load it (UI:R); arbitrary file write gives I:H, modest read/availability impact via overwriting configs and datasets.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat 8.1 HIGH

Primary rating from Vendor (huntr).

CVSS VectorVendor: huntr

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 16:16 EUVD

CVE Published

Jun 11, 2026 - 14:16 cve.org

HIGH 8.1

DescriptionCVE.org

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/file_utils.py. The functions filter_safe_tarinfos() and filter_safe_zipinfos() validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to /, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an AttributeError when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the filter="data" safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 1 Critical, 5 High, 3 With POC Jun 12, 2026

Executive ViewAI

Why It Matters

Keras versions prior to 3.14.0 contain a path traversal vulnerability allowing remote attackers to write arbitrary files outside the intended extraction directory when processing malicious model archives, with heightened risk in containerized and CI/CD machine learning environments. This vulnerability could enable attackers to inject malicious code into ML pipelines and compromise infrastructure if untrusted model files are processed.

Business Impact: High

Compensating Controls

Vendor-released patch: Keras 3.14.0. Pending patch deployment: restrict model archive loading to internally vetted repositories only; disable model archive extraction features if unused; implement container-level file system sandboxing with read-only root filesystems; monitor for unauthorized file creation during model load operations.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Threat Intel

1 sources

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA MSRC Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.