Introduction
A flaw in how Keras extracts tar archives lets attackers write arbitrary files on systems running a vulnerable installation. It directly affects any machine learning workflow that uses Keras utilities to download and unpack datasets or models from external sources.
Keras is a widely adopted deep learning framework maintained by Google and the open-source community. Researchers, enterprises, and cloud services around the world use it, it has millions of downloads, and major platforms integrate it. The keras.utils.get_file() function is a common utility for managing datasets and models, so a vulnerability there has a wide reach across the machine learning ecosystem.
Technical information
CVE-2025-12060 affects the keras.utils.get_file() function when it downloads and extracts tar archives. With the extract parameter set to True, get_file() hands extraction to Python's tarfile.extractall() method. In affected versions, that call does not pass the filter='data' parameter, which is needed to block path traversal attacks that use symlinks inside the archive.
An attacker can build a tar archive containing symbolic links that point outside the intended extraction directory. When a vulnerable Keras installation processes that archive, it can write files to arbitrary locations on the filesystem, limited only by the permissions of the running process. If the attacker targets sensitive locations, this can lead to system compromise or arbitrary code execution.
A bug in symlink resolution related to path length limits complicates things further. Keras tries to filter unsafe paths with a function called filter_safe_paths(), but that check runs before extraction. During extraction, the tarfile module's symlink resolution can fail because of these path length issues, which bypasses the intended security checks.
The patch adds a new extraction function. On Python 3.12 and later it uses filter='data', which gives strong protection against path traversal. On earlier Python versions it uses a custom filter that validates symlink targets more effectively. The vulnerability is closely related to Python's CVE-2025-4517, which affects how tarfile handles symlinks and path traversal.
No public proof-of-concept code is available at the time of writing, but the technical details are enough for attackers to build malicious archives that exploit the flaw.
Affected systems and versions
- Keras versions prior to 3.12.0 are affected.
- The vulnerability affects any use of keras.utils.get_file() with extract=True on tar or tar.gz archives.
- Systems running a Python version vulnerable to CVE-2025-4517 face additional risk if Keras is not updated.
Vendor security history
Keras has had earlier vulnerabilities in file handling and model deserialization, including issues with Lambda layer deserialization and unsafe model loading. Past releases fixed those. The Keras team takes part in coordinated disclosure programs such as huntr and has responded quickly to security reports. The fix for CVE-2025-12060 shipped promptly in version 3.12.0, with improved extraction logic for both new and legacy Python environments.
