Keras keras.utils.get_file Utility Path Traversal Vulnerability

🗓️ 01 Nov 2025 08:01:19Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 9 Views

Keras get_file utility path traversal vulnerability reported by Microsoft.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Python affect IBM Robotic Process Automation	16 Jan 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.	29 Dec 202505:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in keras-3.11.3-py3-none-any.whl	4 Feb 202622:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses keras-3.10.0-py3-none-any.whl, keras-2.14.0-py3-none-any.whl which are vulnerable to CVE-2025-12058, CVE-2025-12060, CVE-2025-9905, CVE-2025-9906.	30 Jan 202605:35	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary File Read, SSRF, and Code Execution Vulnerabilities in TensorFlow Keras Model Loading (v2.13) affects watsonx.data	8 Apr 202608:40	–	ibm
Huntr	Symlink Member Name Not Validated in filter_safe_tarinfos — Symlink Created Outside Extraction Directory	15 Apr 202605:12	–	huntr
Huntr	Patched get_file tar traversal remains exploitable on supported Python 3.11	1 May 202614:16	–	huntr
Huntr	Path Traversal in Keras Archive Extraction via CWD Validation Bypass Leading to Arbitrary File Write	13 Mar 202613:22	–	huntr
CBLMariner	CVE-2025-12060 affecting package keras for versions less than 3.3.3-5	6 Nov 202515:48	–	cbl_mariner
Chainguard	CVE-2025-12060 vulnerabilities	4 Nov 202501:23	–	cgr

Vulners

Node

microsoft azl3_keras_3.3.3-4Range<3.3.3-5

01 Nov 2025 08:01Current

7High risk

Vulners AI Score7

CVSS 48.9

EPSS0.00584

SSVC

Keras get_file path traversal vulnerability Microsoft