CVE-2025-12058
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-10-30

Assigner: Google Inc.

Description
The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path. * Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will attempt to read the content of the specified local file and incorporate it into the model state (e.g., retrievable via get_vocabulary()), allowing an attacker to read arbitrary local files on the hosting system. * Server-Side Request Forgery (SSRF): Keras utilizes tf.io.gfile for file operations. Since tf.io.gfile supports remote filesystem handlers (such as GCS and HDFS) and HTTP/HTTPS protocols, the same mechanism can be leveraged to fetch content from arbitrary network endpoints on the server's behalf, resulting in an SSRF condition. The security issue is that the feature allowing external path loading was not properly restricted by the safe_mode=True flag, which was intended to prevent such unintended data access.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-29
Last Modified
2025-10-30
Generated
2026-05-07
AI Q&A
2025-10-29
EPSS Evaluated
2026-05-05
NVD
CVE-2025-12058
EUVD
EUVD-2025-36634
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
keras keras *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects the Keras.Model.load_model method, where loading a specially crafted .keras model file can lead to arbitrary local file reading and Server-Side Request Forgery (SSRF). It arises because the StringLookup layer's vocabulary argument can specify local or remote file paths. When loading the model, Keras reads these paths without proper restriction, even when safe_mode=True is set, allowing attackers to read local files or make the server fetch data from arbitrary network locations.


How can this vulnerability impact me? :

An attacker exploiting this vulnerability can read arbitrary local files on the server hosting the Keras model, potentially exposing sensitive information. Additionally, the attacker can cause the server to make network requests to arbitrary endpoints (SSRF), which could be used to access internal services, perform reconnaissance, or launch further attacks within the network.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart