CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (`..`). While forward slashes (`/`) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.

• CWE-22

• https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743
• https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743

Published

Jun 22, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12471The Spexo theme for WordPress is vulnerable to unauthorized …4.3
• CVE-2026-12472The Kirki – Freeform Page Builder, Website Builder & Customi…5.3
• CVE-2026-12473Two data sources (DICOMWebProxy and DICOMJSON) shipped in th…8.3
• CVE-2026-12475Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-12476The Easy Digital Downloads plugin for WordPress is vulnerabl…7.2
• CVE-2026-12478The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) pl…4.8
• CVE-2026-1248IBM Business Automation Workflow containers and traditional …4.3
• CVE-2026-12480Keras versions up to and including 3.13.2 are vulnerable to …5.5
• CVE-2026-12481A vulnerability in keras-team/keras version 3.14.0 allows fo…9.8
• CVE-2026-12482A vulnerability in keras-team/keras version 3.12.0 allows an…6.5
• CVE-2026-12484A vulnerability in keras-team/keras version 3.15.0 allows un…7.8
• CVE-2026-12485GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10