DEBIAN-CVE-2025-12060

    Dashboard / Vulnerabilities / DEBIAN-CVE-2025-12060

    DEBIAN-CVE-2025-12060

    Published: 30 Oct 2025Last Modified: 27 Aug 2026
    Upstream:
    CVE-2025-12060

    Summary:

    Details: The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).

    References: https://security-tracker.debian.org/tracker/CVE-2025-12060

    Affected packages

    Package

    Name: keras

    Purl: pkg:deb/debian/keras?arch=source&distro=bullseye

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    2.3.1+dfsg-3
    2.3.1+dfsg2-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2025-12060 | CVE-DB