UBUNTU-CVE-2026-12479

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-12479

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12479.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-12479

Upstream

CVE-2026-12479

Published

2026-06-22T16:16:00Z

Modified

2026-06-24T11:01:25Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the DiskIOStore.make method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (..). While forward slashes (/) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.

References

Affected packages

Ubuntu:18.04:LTS / keras

Package

Name: keras
Purl: pkg:deb/ubuntu/keras?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.7-2

2.*

2.1.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-keras",
            "binary_version": "2.1.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12479.json"

Ubuntu:20.04:LTS / keras