The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is
    vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the
    filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks,
    which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of
    the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness,
    identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517
    (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix
    (Keras 3.12). (CVE-2025-12060)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is     vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the     filter=data feature. A remote attacker can craft a malicious tar archive containing special symlinks,     which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of     the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness,     identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517     (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix     (Keras 3.12). (CVE-2025-12060)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
437064	SCA: security update for keras (GHSA-hjqc-jx6g-rwp9)	Tenable Cloud Security	SCA Checks	Local	high
437064	SCA: security update for keras (GHSA-hjqc-jx6g-rwp9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
435905	SCA: security update for keras (GHSA-28jp-44vh-q42h)	Tenable Cloud Security	SCA Checks	Local	high
435905	SCA: security update for keras (GHSA-28jp-44vh-q42h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
272074	Linux Distros Unpatched Vulnerability : CVE-2025-12060	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-12060

high

Tenable Plugins

high

high

high

high

high