CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (`..`). While forward slashes (`/`) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.

• CWE-22

• https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743
• https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743

Published

Jun 22, 2026

Last Modified

Oct 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124760P-Net before 1.0.4 sets the alarm receiver state to waiting …2.3
• CVE-2026-124761P-Net before 1.0.4 copies the IP suite of a DCP Set request …7.1
• CVE-2026-124762P-Net before 1.0.4 finds the RPC session of a received PDU b…6
• CVE-2026-124763The Woocommerce Wishlist WordPress plugin through 1.1.0 does…
• CVE-2026-12477The Gravity Booster – Styles & Layouts for Gravity Forms plu…4.4
• CVE-2026-12478The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) pl…4.8
• CVE-2026-1248IBM Business Automation Workflow containers and traditional …4.3
• CVE-2026-12480Keras versions up to and including 3.13.2 are vulnerable to …5.5
• CVE-2026-12481A vulnerability in keras-team/keras version 3.14.0 allows fo…9.8
• CVE-2026-124814The Ultimate Addons for Elementor Forms WordPress plugin bef…9.8
• CVE-2026-124815The Clockinator Lite WordPress plugin before 1.1.0 does not …10
• CVE-2026-124817The Clockinator Lite WordPress plugin before 1.1.0 does not …5.3