The vulnerability CVE-2025-9905 in Red Hat OpenShift AI (RHOAI) versions >=2.22.0 <2.22.3 is a path traversal flaw originating from the keras Python library's use of tarfile.extractall without proper filtering. An attacker can craft malicious tar archives containing special symlinks that, when extracted with the extract=True option, allow writing arbitrary files outside the intended directory. This can lead to unauthorized code execution, file modification, or data disclosure. The issue is tracked under multiple CWEs including CWE-22 (Path Traversal) and CWE-913 (Improper Control of Dynamically-Managed Code Resources). Red Hat has released RHOAI 2.22.3 with updated images to mitigate this vulnerability. The vendor advisory notes no known exploits in the wild and provides upgrade instructions.

Successful exploitation allows a remote attacker to write arbitrary files anywhere on the filesystem outside the intended extraction folder, potentially leading to unauthorized code execution, modification or creation of critical files, disclosure of sensitive information, or denial of service by corrupting essential files. The vulnerability affects confidentiality, integrity, and availability of the affected systems. No active exploitation has been reported.

Red Hat has released RHOAI version 2.22.3 which addresses this vulnerability. Users should upgrade their Red Hat OpenShift AI clusters to version 2.22.3 following the official Red Hat documentation and upgrade instructions. No alternative mitigations meeting Red Hat's criteria are currently available. Applying the official update is the recommended and supported remediation.