Keras Path Traversal PoC (CWE-22)

Vulnerability

keras/src/utils/file_utils.py line 48 uses startswith(base_dir) without + os.sep. A path resolving to a sibling directory with a matching prefix (e.g., cifar10_poisoned starts with cifar10) passes the check.

Files

malicious_dataset.tar.gz — Archive with prefix-bypass entry
poc.py — Demonstrates the bypass

Reproduce

pip install keras
python poc.py

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support