CVE-2025-12638 is a path traversal vulnerability in Keras, impacting the Red Hat Trusted Artifact Signer (RHTAS) Model Transparency CLI image. The issue arises because the tarfile.extractall() function is called without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths before extraction, a symlink resolution bug triggered by path length limits (PATH_MAX) causes the filtering to be bypassed during extraction. This allows an attacker to write files outside the intended directory, potentially modifying or creating critical files, reading sensitive data, or causing denial of service. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-770, and CWE-409. Red Hat has not released a patch or fix for this vulnerability in the affected RHTAS 1.3.2 Tech Preview release, and mitigation options currently do not meet Red Hat's criteria for ease of use, applicability, or stability.

The vulnerability allows an attacker to write files outside the intended extraction directory, potentially overwriting or creating critical files such as programs, libraries, or security mechanisms. This can lead to unauthorized code execution, bypass of security controls, exposure of sensitive data, or denial of service by corrupting essential files. The impact affects confidentiality, integrity, and availability of the system using the affected RHTAS Model Transparency CLI image.

No official fix or patch is currently available from Red Hat for this vulnerability. Red Hat states that available mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and consider restricting usage or applying custom mitigations where feasible. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance. No immediate vendor-recommended mitigation is provided.