This vulnerability arises from improper limitation of pathnames during tar archive extraction in keras-team/keras 3.12.0. The function filter_safe_tarinfos in keras/src/utils/file_utils.py fails to apply the is_path_in_dir validation to symlink entries, enabling crafted tar archives to create symlinks outside the target directory. This flaw can be exploited to perform symlink-based file read or overwrite attacks, or to escape the intended extraction directory. The vulnerability is distinct from other known issues such as CVE-2025-12060 and is particularly relevant on Python 3.10 and 3.11 where this function is the sole protection against path traversal in tar extraction.

An attacker can craft a malicious tar archive that, when extracted by the vulnerable keras version, creates symlinks outside the intended directory. This can lead to unauthorized file reads, file overwrites, or directory escapes. The impact is limited to integrity and availability with no direct confidentiality loss reported. The CVSS score of 3.1 reflects low severity, requiring high attack complexity and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a fix is released, users should avoid extracting untrusted tar archives with the affected keras version or apply manual validation of tar contents before extraction.