CVE-2025-12060

🗓️ 30 Oct 2025 17:10:43Reported by GoogleType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 36 Views

CVE-2025-12060: Keras get_file tar extraction allows path traversal; Python upgrade alone is insufficient; update Keras to 3.12.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Python affect IBM Robotic Process Automation	16 Jan 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.	29 Dec 202505:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in keras-3.11.3-py3-none-any.whl	4 Feb 202622:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses keras-3.10.0-py3-none-any.whl, keras-2.14.0-py3-none-any.whl which are vulnerable to CVE-2025-12058, CVE-2025-12060, CVE-2025-9905, CVE-2025-9906.	30 Jan 202605:35	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary File Read, SSRF, and Code Execution Vulnerabilities in TensorFlow Keras Model Loading (v2.13) affects watsonx.data	8 Apr 202608:40	–	ibm
CBLMariner	CVE-2025-12060 affecting package keras for versions less than 3.3.3-5	6 Nov 202515:48	–	cbl_mariner
Chainguard	CVE-2025-12060 vulnerabilities	4 Nov 202501:23	–	cgr
Circl	CVE-2025-12060	30 Oct 202517:25	–	circl
CNNVD	Keras 安全漏洞	30 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability	30 Oct 202517:10	–	cvelist

Vulners

CNA

Node

keras kerasRange3.0.0–3.11.3

[
  {
    "collectionURL": "https://github.com/keras-team/keras/",
    "defaultStatus": "unaffected",
    "packageName": "util",
    "product": "Keras",
    "programFiles": [
      "get_file"
    ],
    "vendor": "Keras",
    "versions": [
      {
        "lessThanOrEqual": "3.11.3",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9
github	www.github.com/keras-team/keras/pull/21760

15 Apr 2026 00:35Current

6.8Medium risk

Vulners AI Score6.8

CVSS 48.9

EPSS0.00105

SSVC

CWE-22