AIKIDO-2026-361481
keras is vulnerable to Path Traversal
74
CVE Score
High
Path Traversal
TL;DR
safe_get_h5_group and safe_get_h5_dataset reject HDF5 ExternalLink/SoftLink members by inspecting only the final path component. When a multi-component name such as ext/kernel places an ExternalLink on an intermediate segment, h5py follows it into another file and the guard never checks that link. Attacker-controlled weight_names / layer_names in a crafted .weights.h5 or .keras archive can therefore read arbitrary readable HDF5 files on the host during model.load_weights() or keras.saving.load_model(), including under default safe_mode=True. The fix walks each path segment and verifies the link and group type at every step before descending.
How do I fix this?
Upgrade the keras library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load untrusted .weights.h5 or .keras model files.
Package
Versions
3.12.2 - 3.12.3
Fixed in 3.12.43.14.1 - 3.15.0
Fixed in 3.15.1Background info
keras is vulnerable to Path Traversal in versions 3.12.2 - 3.12.3 and 3.14.1 - 3.15.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.