Keras Archive Extraction Path Traversal

Craft the Malicious Archive

The attacker crafts a tar.gz or ZIP file containing members with traversal paths — e.g., ../../usr/lib/python3/dist-packages/keras/__init__.py — or symlinks pointing outside the extraction root. The archive otherwise looks like a legitimate model weights file (correct filename, plausible size, matching the expected content type). For ZIP archives no crafting sophistication is needed at all — the AttributeError means any traversal entry silently extracts.

Audit every keras.utils.get_file() call in your codebase. Any call with extract=True that pulls from a URL you do not fully control is exploitable on Keras < 3.14.0.

Deliver via Model Hub or Compromised Artifact Source

The malicious archive is served from an attacker-controlled host, a compromised model hub mirror, a poisoned S3 bucket, or a dependency confusion attack against an internal artifact registry. Keras fetches the archive over HTTPS and optionally validates a caller-supplied file_hash — but if the training script omits the hash (the common case), there is no integrity check whatsoever before extraction begins.

Always supply file_hash in every keras.utils.get_file() call and pin it to a known-good SHA-256. Use a private artifact registry rather than pulling directly from public URLs in production training jobs.

Bypass Extraction Filter via CWD=/

Keras calls filter_safe_tarinfos() or filter_safe_zipinfos(). Both resolve paths against os.getcwd(). In Docker (WORKDIR defaults to /), CI/CD runners, and Jupyter kernels, CWD is /. The check resolved.startswith("/") is always True — every path, including /etc/passwd or /usr/lib/python3/..., passes. For ZIPs, the filter crashes before it can block anything.

Set an explicit WORKDIR /app (or equivalent non-root path) in all Docker images that run Keras. This limits the traversal base to /app, reducing blast radius even on unpatched versions.

Arbitrary File Write — Code Injection or Pivot

With traversal unrestricted the attacker writes to any path the process user can reach: overwriting a Python module in site-packages to persist a backdoor across container restarts (when shared volumes are mounted), injecting a malicious __init__.py into a frequently-imported package, appending to ~/.ssh/authorized_keys for persistent shell access, reading the Kubernetes service account token at /var/run/secrets/kubernetes.io/serviceaccount/token, or corrupting training datasets before the training loop begins.

After any get_file(extract=True) call on an untrusted archive, verify no files landed outside the cache dir: find /root/.keras -name "*.py" 2>/dev/null | xargs grep -l "import subprocess\|__import__\|exec(" 2>/dev/null. Any hit is a compromised environment — rebuild from a clean image.

Silent Persistence in MLOps Pipeline

Because the injected code executes as part of a legitimate training run, it blends into normal CI/CD output. Backdoored weights or poisoned dataset files can propagate through model versioning systems (MLflow, W&B, SageMaker Model Registry) to production inference endpoints. A compromised container image layer can be committed to an ECR/GCR registry if the CI/CD step rebuilds and pushes after training, propagating the compromise downstream to every deployment that pulls the image.

Treat any model artifact produced by a training run on a host that loaded an unverified archive as untrusted until a clean re-run is completed. Enforce image provenance checks (Cosign/Sigstore) in your model deployment pipeline.