The vulnerability CVE-2025-9905 is a path traversal flaw in the keras Python library when used with the extract=True option for tar archives. The issue arises because the tarfile.extractall function is used without proper filtering, allowing specially crafted tar archives with malicious symlinks to write files outside the intended extraction directory. This can enable an attacker to overwrite or create critical files, potentially leading to unauthorized code execution, data disclosure, or denial of service. Red Hat OpenShift AI versions >=2.25.0 and <2.25.1 are affected. Red Hat has released OpenShift AI 2.25.1 with fixes. The vulnerability is rated high severity by Red Hat, with a CVSS v3 base score of 8.3 according to Red Hat's assessment. No exploits are currently known in the wild.

An attacker can remotely supply a malicious tar archive that, when extracted by the vulnerable keras library, writes files to arbitrary locations outside the intended directory. This can lead to unauthorized modification or creation of critical files, potentially allowing code execution, bypass of security mechanisms, exposure of sensitive data, or denial of service conditions by corrupting important files. The impact affects confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity rating by Red Hat with a CVSS score of 8.3.

Red Hat has released OpenShift AI version 2.25.1 which addresses this vulnerability. Users should upgrade to version 2.25.1 or later to fully remediate the issue. No alternative mitigations meeting Red Hat's criteria are currently available. Follow Red Hat's official upgrade documentation to apply the update correctly.