The vulnerability (CVE-2026-11816) in keras-team/keras affects versions before 3.14.0. It is a path traversal issue (CWE-22) in the archive extraction functions filter_safe_tarinfos() and filter_safe_zipinfos() located in keras/src/utils/file_utils.py. These functions validate archive member paths against the process's current working directory (CWD) instead of the actual extraction destination. When the CWD is set to '/', common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass security checks. The zip filter also has a bug causing an AttributeError when a blocked entry is encountered, resulting in incomplete extraction. Python 3.11 installations lack the filter="data" safety net, making them fully dependent on the flawed CWD-based filter. This vulnerability can be exploited to write arbitrary files outside the intended extraction directory, enabling attackers to overwrite configuration files, inject malicious code, or corrupt machine learning datasets and pipelines. The CVSS v3.0 score is 8.1 (High), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts.

Exploitation of this vulnerability allows an attacker to perform arbitrary file writes outside the intended extraction directory. This can lead to overwriting critical configuration files, injecting malicious code, or corrupting machine learning datasets and pipelines. The vulnerability affects confidentiality and integrity but does not impact availability. The high CVSS score reflects the significant risk of unauthorized data modification and potential system compromise in affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no explicit mention of an official fix or patch availability in the provided vendor advisory content. Users should monitor the official Keras project and vendor advisories for updates. Until a patch is available, avoid running Keras archive extraction in environments where the current working directory is set to the filesystem root, such as certain Docker containers or CI/CD runners. Consider running extraction processes with a controlled working directory and apply additional manual path validation if possible.