Keras: DiskIOStore permits path traversal through crafted layer names

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths...

GHSA-GH82-F9X8-5FRX Keras: DiskIOStore permits path traversal through crafted layer names

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths...

CVE-2026-12479

Removed by vendor...

PT-2026-51329

Name of the Vulnerable Software and Affected Versions keras-team/keras version 3.14.0 Description A path traversal issue exists in the Keras 3 model saving and loading library. The DiskIOStore.make function fails to sanitize user-provided layer names for parent directory components .. when...