The vulnerability exists in keras-team/keras version 3.14.0 within the DiskIOStore.make method used for model saving and loading. User-supplied layer names are incorporated into directory paths without proper sanitization against parent directory components ('..'), enabling path traversal. Although forward slashes are restricted, directory traversal sequences are not, allowing crafted Keras models to escape the temporary working directory and perform unauthorized file system writes or directory creation outside the intended scope.

An attacker can exploit this vulnerability by crafting malicious Keras models that, when saved or loaded, escape the designated temporary directory and write files or create directories arbitrarily on the file system. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, avoid loading or saving untrusted Keras models or restrict usage to trusted sources only.