What is the CVSS score of CVE-2026-12479?

CVE-2026-12479 has a CVSS 3.0 base score of 6.1 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-12479?

Yes, a patch is available for CVE-2026-12479. Update the affected software to the latest version immediately.

Keras CVE-2026-12479

EUVD-2026-38265 MEDIUM

Path Traversal (CWE-22)

2026-06-22 @huntr_ai

GHSA-gh82-f9x8-5frx

Path Traversal Red Hat Keras Team Keras Keras Team

6.1

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

AV:L because the path traversal triggers during local model load/save; UI:R because victim must actively open the crafted model; S:C reflects file writes escaping the intended Keras temporary directory boundary.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:09 vuln.today

CVE Published

Jun 22, 2026 - 15:21 cve.org

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (..). While forward slashes (/) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.

AnalysisAI

Path traversal in Keras 3.14.0 exposes local file systems to arbitrary file and directory creation when processing maliciously crafted model files. The DiskIOStore.make method constructs directory paths from user-supplied layer names without sanitizing directory traversal sequences (..); since only forward slashes are blocked, embedding .. components in a layer name allows escape from the intended temporary working directory during model save or load operations. No active exploitation (CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, EPSS data was not provided, leaving probabilistic exploitation likelihood unquantified.

Technical ContextAI

Keras 3 uses a DiskIOStore abstraction for model serialization, where the make method is responsible for constructing on-disk directory structures that mirror the model's layer hierarchy. Layer names sourced from model metadata are concatenated directly into file system paths without stripping parent directory components (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). While the implementation blocks forward slashes (/) in layer names as a partial defense, it fails to reject or normalize sequences such as '..' which are equally effective for traversal on POSIX and Windows systems. The CPE cpe:2.3:a:keras-team:keras-team/keras:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the affected version range beyond 3.14.0 is not precisely bounded in available intelligence. The attack surface is the model deserialization pipeline, a class of vulnerability increasingly common in ML frameworks where model files are treated as trusted data.

RemediationAI

No vendor-released patch or confirmed fixed version is identified in the available data - patch availability is unknown at time of analysis. Users should monitor the huntr bounty advisory at https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743 and the keras-team/keras GitHub repository for an official fix. As an immediate compensating control, avoid loading Keras models from untrusted or unverified sources, as model files are the delivery mechanism for this attack. If model loading from external sources is operationally required, implement a pre-load validation step that inspects all layer names for directory traversal sequences (e.g., reject any name containing ..) before invoking save or load methods; this adds a processing step but prevents exploitation without waiting for an upstream patch. Additionally, restrict the OS-level write permissions of the process running Keras to the minimum required directories, so that even if traversal succeeds, the process cannot write to sensitive system paths - this reduces impact but does not eliminate the vulnerability. Sandboxing model loading in a container or restricted environment with read-only mounts to critical paths is a high-efficacy workaround with the trade-off of added operational complexity.