Path Traversal in Keras 3.12.0 via Malicious Tar Archive

Executive Summary

CVE-2026-12482 is a vulnerability in keras-team/keras version 3.12.0. It involves a flaw in the `filter_safe_tarinfos` validation mechanism located in `keras/src/utils/file_utils.py`.

The vulnerability allows an attacker to create a malicious tar archive that bypasses security checks. Specifically, symlink entries in the tar archive are not validated using the `is_path_in_dir` function, unlike regular file entries. This oversight permits the creation of symlinks outside the intended extraction directory.

As a result, this can lead to symlink-based attacks, including unauthorized file reads, file overwrites, or directory escape. The impact is particularly severe on Python versions 3.10 and 3.11, where `filter_safe_tarinfos` is the only protection against tar path traversal attacks.

This issue is distinct from other previously reported vulnerabilities, such as CVE-2025-12060.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your system or network is using the affected version of keras (3.12.0) and verifying whether the vulnerable code path in `keras/src/utils/file_utils.py` is present. Since the issue involves improper handling of symlinks in tar archives, you can also inspect systems for unexpected symlinks or files created outside intended directories.

• Check the installed version of keras: Run `pip show keras` or `pip list | grep keras` to verify if version 3.12.0 is installed.
• Inspect the source code: If you have access to the keras installation directory, check `keras/src/utils/file_utils.py` for the `filter_safe_tarinfos` function. Look for the absence of symlink validation in the function logic.
• Monitor for suspicious symlinks: Use commands like `find /path/to/directory -type l` to search for symlinks in directories where keras might extract files. Check if any symlinks point outside the intended extraction directory.
• Test for vulnerability: If feasible, attempt to craft a malicious tar archive with symlinks and observe if the system allows extraction outside the intended directory. This should only be done in a controlled environment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using keras-team/keras version 3.12.0, especially on Python 3.10 or 3.11:

• An attacker could exploit this flaw to read sensitive files on your system by creating symlinks that point to files outside the intended extraction directory.
• The vulnerability could allow an attacker to overwrite critical files, potentially leading to data corruption or unauthorized modifications.
• It may enable directory escape attacks, where an attacker gains access to directories they should not have access to, compromising system security.

The CVSS score of 3.1 indicates a low severity, but the impact depends on how the vulnerable component is used in your environment. If keras is used to process untrusted tar archives, the risk increases.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR: If the vulnerability leads to unauthorized access or disclosure of personal data, it could result in a violation of GDPR requirements for data protection and confidentiality. Organizations may face fines or legal consequences if they fail to mitigate such risks.
• HIPAA: For organizations handling protected health information (PHI), this vulnerability could lead to unauthorized access or modification of sensitive data. This may violate HIPAA's Security Rule, which mandates safeguards to protect the integrity and confidentiality of PHI.
• Other standards: Compliance frameworks like ISO 27001 or NIST require organizations to manage vulnerabilities and protect against unauthorized access. Failure to address this vulnerability could result in non-compliance with these standards.

The specific impact on compliance depends on how the vulnerable software is used and whether it processes sensitive or regulated data. Organizations should assess their exposure and apply patches or mitigations to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps to reduce exposure and prevent exploitation.

• Upgrade keras: If a patched version is available, upgrade to the latest version of keras that addresses this issue. Use `pip install --upgrade keras` to update.
• Apply temporary workarounds: If upgrading is not immediately possible, restrict the use of tar extraction functions in keras or implement additional validation for symlinks in tar archives before extraction.
• Limit permissions: Ensure that the user or service running keras has minimal permissions, particularly restricting write access to sensitive directories.
• Monitor for exploitation: Set up monitoring for unusual file creation or symlink activity in directories where keras operates. Log and alert on any suspicious activity.
• Isolate affected systems: If the vulnerability is confirmed, isolate systems running the affected version of keras to prevent potential lateral movement or further exploitation.

Useful 0 Not Useful 0