CVE-2026-12482: Keras Path Traversal Vulnerability

CVE-2026-12482 Overview

CVE-2026-12482 is a path traversal vulnerability in keras-team/keras version 3.12.0. The flaw resides in the filter_safe_tarinfos function within keras/src/utils/file_utils.py. Symlink entries in tar archives bypass the is_path_in_dir validation that is applied to regular file entries. Attackers can craft malicious tar archives containing symlinks that resolve outside the intended extraction directory. Successful exploitation enables arbitrary file read, file overwrite, or directory escape attacks. The issue affects Python 3.10 and 3.11 environments most severely, where filter_safe_tarinfos serves as the sole tar path traversal defense. This vulnerability is distinct from CVE-2025-12060 and other previously disclosed Keras archive-handling issues.

Critical Impact
A crafted tar archive processed by Keras 3.12.0 can create symlinks outside the extraction directory, leading to file overwrite or directory escape on Python 3.10 and 3.11.

Affected Products

keras-team/keras version 3.12.0
Python 3.10 runtime environments using Keras archive utilities
Python 3.11 runtime environments using Keras archive utilities

Discovery Timeline

2026-07-14 - CVE-2026-12482 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-12482

Vulnerability Analysis

The vulnerability is classified as a path traversal weakness [CWE-22] affecting Keras archive extraction logic. Keras uses the filter_safe_tarinfos function to validate each TarInfo entry before extraction. The function calls is_path_in_dir to confirm that regular file entries resolve inside the target directory. Symlink entries skip this check entirely. Attackers who supply a malicious model archive can therefore include symlink members that reference absolute paths or use .. sequences. When extraction proceeds, Python creates the symlink on disk, and subsequent operations that follow the symlink write to or read from arbitrary locations. Exploitation requires user interaction, since the victim must load or extract the attacker-supplied archive through the Keras utilities.

Root Cause

The root cause is incomplete input validation inside filter_safe_tarinfos in keras/src/utils/file_utils.py. The function branches on entry type but only validates regular files against the destination directory. Symlink and hard link entries pass through without target-path normalization. On Python 3.10 and 3.11, this function is the only tar safety filter in place. Python 3.12 and later provide the data_filter behavior in tarfile, which mitigates but does not fully replace application-level checks.

Attack Vector

Exploitation requires an attacker to deliver a crafted tar archive to a victim who then loads it through Keras utilities such as model download or dataset loading helpers. The archive contains symlink entries whose targets point outside the extraction directory. When Keras extracts the archive, the symlinks are written to disk. A follow-up write or read operation traversing those symlinks results in file overwrite, sensitive file disclosure, or writes into system-controlled paths. The Huntr bounty listing linked in the references contains the disclosure details.

No verified exploit code has been published. See the Huntr Bounty Listing for the technical writeup.

Detection Methods for CVE-2026-12482

Indicators of Compromise

Unexpected symlinks created inside directories used by Keras for model or dataset extraction.
Symlinks whose targets point to absolute paths outside the extraction root or contain .. traversal sequences.
Tar archive files loaded by Python processes running Keras 3.12.0 on Python 3.10 or 3.11.
File writes or reads by Python processes that resolve to unexpected system locations after archive extraction.

Detection Strategies

Inspect tar archives before extraction using tarfile inspection tooling to enumerate symlink members and their targets.
Monitor for calls to filter_safe_tarinfos in application logs when Keras 3.12.0 is present in the environment.
Audit machine learning pipelines for use of untrusted model or dataset archives sourced from third parties.
Flag process telemetry showing Python interpreters creating symlinks outside expected working directories.

Monitoring Recommendations

Enable file integrity monitoring on directories used by data science workloads and model registries.
Log all archive extraction operations performed by ML training and inference services.
Alert on symlink creation events originating from Python processes hosting Keras workloads.
Track outbound network requests that fetch model archives so ingestion sources can be traced.

How to Mitigate CVE-2026-12482

Immediate Actions Required

Upgrade Keras beyond version 3.12.0 once a patched release addressing symlink validation is available.
Restrict model and dataset ingestion to trusted internal sources until the patch is applied.
Where possible, run Keras workloads on Python 3.12 or later to benefit from the tarfiledata_filter default.
Sandbox archive extraction using containers or unprivileged user accounts with restricted filesystem access.

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Monitor the Huntr Bounty Listing and the keras-team/keras GitHub repository for the fix commit and updated release. Apply the patched version to all training, inference, and CI environments that consume tar archives.

Workarounds

Pre-scan tar archives with a wrapper that rejects entries where tarinfo.issym() or tarinfo.islnk() is true and the resolved target is outside the extraction directory.
Extract archives to disposable directories on isolated volumes with no sensitive files or symlink-followable targets.
Disable automatic download and extraction features in Keras helpers such as get_file when the source cannot be authenticated.
Pin production environments to Python 3.12 or later to leverage the built-in tarfile filter as a secondary defense.

bash

# Configuration example: validate tar archives before Keras extraction
python - <<'EOF'
import tarfile, os, sys
archive = sys.argv[1]
dest = os.path.abspath(sys.argv[2])
with tarfile.open(archive) as tf:
    for member in tf.getmembers():
        if member.issym() or member.islnk():
            target = os.path.abspath(os.path.join(dest, member.linkname))
            if not target.startswith(dest + os.sep):
                raise SystemExit(f"Unsafe link: {member.name} -> {member.linkname}")
    tf.extractall(dest, filter='data')
EOF