CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability
Remote attackers can write arbitrary files to the filesystem via malicious tar archives in Keras get_file utility when extract option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-12060?
CVE-2025-12060 is a high-severity path traversal vulnerability in Keras, published on 30 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).
Weakness: CWE-22
Which versions are affected by CVE-2025-12060?
3 open source packages ship an affected version, including keras.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | All versions | 3.12.0 |
keras PyPI | All versions | 3.12.0 |
keras PyPI | All versions | 3.12.0 |
How do I fix CVE-2025-12060?
Upgrade keras to 3.12.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-12060 being exploited?
There is no known exploitation of CVE-2025-12060 in the wild and no public exploit code.
Sources
Also known as AZL-69472, CLSA-2026-1787149068, DEBIAN-CVE-2025-12060, GHSA-hjqc-jx6g-rwp9, MINI-5g32-8rrh-h62w, PYSEC-2026-1486 and 1 more.