CVE-2026-9335: keras-team keras-team/keras Path Traversal

Vulnerability summary

CVE-2026-9335 is a medium (CVSS 6.5) Path Traversal vulnerability in keras-team keras-team/keras. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities.

Timeline

1. 02-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.