## New challenge worth $15,000

[View details](/content/challenges/1LPL6ZJQapeRqKEFciOg4G/v1/rules/index.html)

##### hertschuh  
@hertschuh  
UNPROVEN  
0 CVEs • 0 vulnerabilities • 8 fixes  
Joined October 2025

### Vulnerabilities Fixed  
- [Path Traversal in Keras Archive Extraction via CWD Validation Bypass Leading to Arbitrary File Write fix in keras-team / keras](/content/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f/index.html) (Jun 9)  
- [Incomplete Fix for CVE-2026-1669: HDF5 External Storage File Disclosure in Legacy H5 Loading fix in keras-team / keras](/content/bounties/ffb64266-295f-431f-adae-eb48da4fbcf7/index.html) (May 26)  
- [model.weights.h5: h5py.ExternalLink at Group level silently followed during load_model(), bypassing CVE-2025-9905 fix — information disclosure from arbitrary HDF5 files fix in keras-team / keras](/content/bounties/e08fc3b8-0eb6-4e4d-bf46-c12131a56a8d/index.html) (May 22)  
- [Infinite Loop Denial of Service via Circular Dependencies in Functional Model Deserialization fix in keras-team / keras](/content/bounties/ffef6867-514e-47c3-a395-32e29305e411/index.html) (May 22)  
- [Path traversal via startswith() prefix confusion in is_path_in_dir (bypass of CVE-2025-12638 fix) fix in keras-team / keras](/content/bounties/ad6c4ec5-c419-4c42-8809-e05502773912/index.html) (May 22)  
- [Arbitrary File Write via Path Traversal in Orbax Checkpoint Asset Dict Keys fix in keras-team / keras](/content/bounties/10cab9c4-59ac-4bc9-b26f-8f73a22339d8/index.html) (May 21)  
- [Zip Slip path traversal in keras.utils.get_file(..., extract=True) archive extraction fix in keras-team / keras](/content/bounties/c8bcd0aa-35e6-4d96-a52b-e2bab8958502/index.html) (May 1)  
- [Path Traversal vulnerability in keras using tar extract fix in keras-team / keras](/content/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4/index.html) (Nov 3)