What is the CVSS score of CVE-2026-11816?

CVE-2026-11816 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Keras are affected by CVE-2026-11816?

Keras versions prior to 3.14.0 contain a path traversal vulnerability allowing remote attackers to write arbitrary files outside the intended extraction directory when processing malicious model…. A patch is available.

How to fix or mitigate CVE-2026-11816?

Within 24 hours: Audit all systems running Keras to identify versions in use and which applications load model archives. Within 7 days: Deploy Keras 3.14.0 or later to staging environments and validate model loading workflows. Within 30 days: Complete production rollout across all systems and implement strict validation on external model sources.

Keras CVE-2026-11816

EUVD-2026-36244 HIGH

Path Traversal (CWE-22)

2026-06-11 security@huntr.dev

GHSA-hqp4-2352-xf5r

Path Traversal Python Docker Keras

8.1

CVSS 3.1 · Vendor: huntr

Severity by source

Vendor (huntr) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

7.6 HIGH

Network-delivered malicious archive, no privileges, requires victim to load it (UI:R); arbitrary file write gives I:H, modest read/availability impact via overwriting configs and datasets.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (huntr).

CVSS VectorVendor: huntr

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 16:16 EUVD

Source Code Evidence Fetched

Jun 11, 2026 - 14:30 vuln.today

Analysis Generated

Jun 11, 2026 - 14:30 vuln.today

CVE Published

Jun 11, 2026 - 14:16 cve.org

HIGH 8.1

DescriptionCVE.org

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/file_utils.py. The functions filter_safe_tarinfos() and filter_safe_zipinfos() validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to /, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an AttributeError when a blocked entry is encountered, leading to incomplete extraction. Furthermore, Python 3.11 installations lack the filter="data" safety net, leaving them entirely reliant on the flawed CWD-based filter. Exploitation of this vulnerability can result in arbitrary file writes outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 1 Critical, 5 High, 3 With POC Jun 12, 2026

AnalysisAI

Path traversal in Keras archive extraction utilities prior to version 3.14.0 allows remote attackers to write files outside the intended extraction directory when a victim loads a malicious model archive. The flaw stems from validating archive member paths against the process current working directory rather than the actual extraction destination, which collapses to the filesystem root in common Docker, CI/CD, and Jupyter setups. No public exploit identified at time of analysis, but the upstream fix and a Huntr bounty disclosure make targeted exploitation against ML pipelines plausible.

Technical ContextAI

The vulnerability lives in filter_safe_zipinfos() and filter_safe_tarinfos() inside keras/src/utils/file_utils.py, which previously hardcoded base_dir = resolve_path(".") instead of receiving the real extraction path. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) realized through an incorrect trust boundary: traversal segments like ../ are compared against CWD, so when CWD is / (typical for containerized Python runtimes), any path stays 'within' the boundary. Compounding factors include an AttributeError bug in the zip filter that aborts iteration on a blocked entry and the absence of Python 3.11's filter="data" tarfile safety net, which is the upstream interpreter mitigation for PEP 706-style tar extraction hardening.

RemediationAI

Upgrade Keras to 3.14.0 or later, which reworks filter_safe_zipinfos() and filter_safe_tarinfos() to take the actual extraction path as base_dir (see commit 2465b6657b02c8eed308759b7e800e295ae01888); released patched version not independently confirmed beyond the description's '3.14.0' string, so verify the tagged release before pinning. As compensating controls until you can upgrade, avoid calling extract_open_archive or loading .keras/.h5 archives from untrusted sources, run training/inference workers with a non-root CWD inside an unprivileged directory (e.g. WORKDIR /workspace in Docker) so the flawed CWD check still rejects most traversals, and prefer Python 3.12+ where tarfile's filter="data" provides a second line of defense - note this changes container ergonomics and may break scripts that assume CWD /. Reference the Huntr bounty page (https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f) for disclosure details.