CVE-2025-12058
Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF
Description
The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path. * Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will attempt to read the content of the specified local file and incorporate it into the model state (e.g., retrievable via get_vocabulary()), allowing an attacker to read arbitrary local files on the hosting system. * Server-Side Request Forgery (SSRF): Keras utilizes tf.io.gfile for file operations. Since tf.io.gfile supports remote filesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content from arbitrary network endpoints on the server's behalf, resulting in an SSRF condition. The security issue is that the feature allowing external path loading was not properly restricted by the safe_mode=True flag, which was intended to prevent such unintended data access.
INFO
Published Date :
Oct. 29, 2025, 9:15 a.m.
Last Modified :
Oct. 19, 2026, 1:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 14ed7db2-1595-443d-9d34-6215bf890778 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Keras to the latest version.
- Review model loading procedures.
- Avoid loading untrusted models.
- Disable external file loading if possible.
Public PoC/Exploit Available at Github
CVE-2025-12058 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-12058.
| URL | Resource |
|---|---|
| https://github.com/keras-team/keras/pull/21751 | |
| https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-12058 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-12058
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Application Security Researcher | Secure Code Review | Vulnerability Research
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-12058 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-12058 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: Keras, Description: El método Keras.Model.load_model, incluso cuando se ejecuta con la mitigación de seguridad prevista safe_mode=True, es vulnerable a la carga arbitraria de archivos locales y a la falsificación de petición del lado del servidor (SSRF). Esta vulnerabilidad se deriva de la forma en que se maneja la capa StringLookup durante la carga del modelo desde un archivo .keras especialmente diseñado. El constructor de la capa StringLookup acepta un argumento vocabulary que puede especificar una ruta de archivo local o una ruta de archivo remota. * Lectura Arbitraria de Archivos Locales: Un atacante puede crear un archivo .keras malicioso que incrusta una ruta local en la configuración de la capa StringLookup. Cuando se carga el modelo, Keras intentará leer el contenido del archivo local especificado e incorporarlo al estado del modelo (por ejemplo, recuperable a través de get_vocabulary()), permitiendo a un atacante leer archivos locales arbitrarios en el sistema anfitrión. * Falsificación de Petición del Lado del Servidor (SSRF): Keras utiliza tf.io.gfile para operaciones de archivos. Dado que tf.io.gfile soporta manejadores de sistemas de archivos remotos (como GCS y HDFS) y protocolos HTTP/HTTPS, el mismo mecanismo puede ser aprovechado para obtener contenido de puntos finales de red arbitrarios en nombre del servidor, lo que resulta en una condición de SSRF. El problema de seguridad es que la característica que permite la carga de rutas externas no fue restringida adecuadamente por el indicador safe_mode=True, el cual estaba destinado a prevenir dicho acceso no intencionado a los datos. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Keras', 'product': 'Keras', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.12.0', 'versionType': 'date'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-12058', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-29T14:07:04.803189Z'} -
New CVE Received by [email protected]
Oct. 29, 2025
Action Type Old Value New Value Added Description The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path. * Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will attempt to read the content of the specified local file and incorporate it into the model state (e.g., retrievable via get_vocabulary()), allowing an attacker to read arbitrary local files on the hosting system. * Server-Side Request Forgery (SSRF): Keras utilizes tf.io.gfile for file operations. Since tf.io.gfile supports remote filesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content from arbitrary network endpoints on the server's behalf, resulting in an SSRF condition. The security issue is that the feature allowing external path loading was not properly restricted by the safe_mode=True flag, which was intended to prevent such unintended data access. Added CVSS V4.0 AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-502 Added Reference https://github.com/keras-team/keras/pull/21751 Added Reference https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f