Homepage

Directory Traversal Affecting py3.11-keras package, versions <3.15.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.65% (48th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-PY311KERAS-18598780
  • published9 Aug 2026
  • disclosed2 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 2 Aug 2026

NewCVE-2026-9335  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Minimos:latest py3.11-keras to version 3.15.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream py3.11-keras package and not the py3.11-keras package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.