CVE-2026-12482Low· 3.1▾ SunlitKeras: tar extraction permits symlink-based path traversal
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filter_safe_tarinfos validation in keras/src/utils/file_utils.py. Specifically, symlink entries are not subjected to the same is_path_in_dir validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where filter_safe_tarinfos is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.
keras < 3.12.3keras >= 3.13.0, < 3.15.0Upgrade to a patched release:
keras 3.12.3keras 3.15.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12484High· 7.8Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
CVE-2026-12479Medium· 6.1Keras: DiskIOStore permits path traversal through crafted layer names
CVE-2026-12480Medium· 5.5Keras: HDF5 virtual datasets can disclose local files
CVE-2026-12570Medium· 5.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function
CVE-2024-55459Mediumkeras Path Traversal vulnerability
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality