The vulnerability in keras-team/keras version 3.12.0 arises from insufficient validation of symlink entries in tar archives during extraction. The function filter_safe_tarinfos in keras/src/utils/file_utils.py does not apply the is_path_in_dir check to symlink entries, enabling attackers to create symlinks that point outside the extraction directory. This can result in symlink-based file read, overwrite, or directory escape attacks. The vulnerability is particularly relevant for Python 3.10 and 3.11 environments where filter_safe_tarinfos is the sole protection against tar path traversal. This issue is distinct from other known Keras vulnerabilities such as CVE-2025-12060. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. Multiple Keras versions are affected, including =1.0.7-2, =2.1.1-1, =2.2.4-1, all versions before 3.12.3, and versions from 3.13.0 up to but not including 3.15.0. A patch is available to fix this vulnerability.

An attacker can craft malicious tar archives that exploit the insufficient validation of symlink entries to perform file read or overwrite operations outside the intended extraction directory. This can lead to unauthorized disclosure of files or modification of files on the system where the archive is extracted. The vulnerability affects confidentiality and integrity but does not impact availability. It requires no privileges or user interaction and can be exploited remotely via network vectors.

A patch is available for this vulnerability. Users should upgrade affected Keras versions to 3.12.3 or later, or to versions 3.15.0 and above where the issue is fixed. Applying the official patch will ensure that symlink entries are properly validated to prevent directory traversal attacks. No additional mitigations are indicated by the vendor advisory.