N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-12060

CVE-2025-12060: Keras keras.utils.get_file API is vulnerable to a path traversal attack

The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-12060

CVE-2025-12060:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keras	pip	< 3.12.0	3.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-12060, is a path traversal weakness in Keras's file extraction functionality. The root cause is the unsafe use of Python's tarfile.extractall function, which is known to be vulnerable to path traversal if not used with proper filters (related to CVE-2007-4559). When a user calls keras.utils.get_file with extract=True on a malicious tar archive, the underlying code can write files outside of the target extraction directory.

The analysis of the fixing commit 47fcb397ee4caffd5a75efd1fa3067559594e951 reveals two vulnerable functions that were patched:

_ArchiveReader.__init__ in keras/src/saving/saving_lib.py: This function performed a direct, unfiltered call to self.archive.extractall(), representing a direct path to exploitation.
extract_archive in keras/src/utils/file_utils.py: This function used a custom but flawed filter (filter_safe_paths) before extraction. This indicates an attempt at security that was ultimately insufficient to prevent the attack.

The patch addresses the vulnerability by introducing a new, secure function extract_open_archive. This function centralizes extraction logic and incorporates the modern filter="data" parameter for tarfile.extractall on compatible Python versions (3.12+), which is the recommended mitigation. For older versions, it uses a more robust custom filter. Both of the originally vulnerable functions were refactored to use this new secure utility. Therefore, during exploitation on a vulnerable version, a runtime profile would show either _ArchiveReader.__init__ or extract_archive as the function that triggers the insecure file extraction.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.