The vulnerability resides in the DiskIOStore.make method of Keras 3.14.0 and allows a malicious model to use unvalidated layer names that contain directory traversal sequences such as "..". These names are concatenated into directory paths without sanitization, letting an attacker create or overwrite files outside the intended temporary working directory. The result is the ability to write arbitrary files, potentially leaking data or installing malicious payloads.

Keras 3.14.0 from the keras-team. The issue affects any installation that processes model files—such as when saving a model through model.save() or loading a model via keras.models.load_model()—since the vulnerable code is invoked during those operations.

The CVSS score of 6.1 indicates a high severity with significant impact on confidentiality, integrity, and availability. Though the EPSS score is not available, the absence of a KEV listing suggests no current widespread exploitation, but the risk remains if an attacker can supply a crafted model. The likely attack vector is file-level injection through a malicious model file, which can be introduced to a machine either through user uploads, data feeds, or code that downloads models from external sources. If exploited, the attacker could elevate file system privileges relative to the application’s running user.