Junglewise Threat Intelligence

CVE-2026-12482: Keras path traversal via symlink in filter_safe_tarinfos

CVE-2026-12482 · Severity: low · CVSS 3.1 · Published 2026-07-14

Technologies: keras (PyPI). Vendors: PyPI.

Executive brief

Keras, a popular deep learning library, contains a vulnerability in how it handles compressed archive files. An attacker could provide a specially crafted archive that, when extracted, creates symbolic links pointing to locations outside the intended folder. This could allow an attacker to overwrite sensitive files or gain unauthorized access to data on the system running the Keras code.

Technical details

A path traversal vulnerability exists in `keras/src/utils/file_utils.py` due to improper validation of symbolic links during tar archive extraction. The `filter_safe_tarinfos` function and its underlying `resolve_path` utility used `os.path.abspath` before `os.path.realpath`. Because `abspath` collapses '..' segments lexically before symlinks are resolved, a path like 'link/../file' could bypass the `is_path_in_dir` containment check if 'link' is a symlink. An attacker can exploit this by crafting a tar archive containing a symlink and a subsequent file entry that resolves through that symlink to a location outside the extraction directory. This is particularly critical on Python 3.10 and 3.11 where Keras's filter is the primary defense. The issue is fixed in versions 3.12.3 and 3.15.0 by ensuring `realpath` is used directly to resolve symlinks before path normalization.

Affected products

  • keras-team Keras 3.12.0, >= 3.13.0, < 3.15.0

Timeline

  • 2026-06-01: patched: Initial fix submitted via PR 23015
  • 2026-06-25: patched: Security release 3.12.3 merged
  • 2026-07-14: disclosed: CVE-2026-12482 published

References

Related threats