CVE-2026-12482 Path Traversal via Symlink Name Validation Bypass in keras-team/keras
Attackers can exploit symlink validation bypass in Keras tar extraction to read or overwrite files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12482?
CVE-2026-12482 is a low-severity path traversal vulnerability in keras-team/keras, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.
Weakness: CWE-22
Which versions are affected by CVE-2026-12482?
5 open source packages ship an affected version, including keras. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | All versions | 3.12.3, 3.15.0 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | From 3.13.0 | 3.15.0 |
keras PyPI | From 3.13.0 | 3.15.0 |
Products include Keras Keras.
How do I fix CVE-2026-12482?
Upgrade keras to a fixed version for your release line: 3.12.3 or 3.15.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-12482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12482 exists.
Other vulnerabilities in keras-team/keras
- CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13
- CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras
- CVE-2026-1462 Safe Mode Bypass in keras-team/keras
- CVE-2025-9906 Arbitrary Code execution in Keras Safe Mode
- CVE-2025-8747 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.
Sources
Also known as DEBIAN-CVE-2026-12482, GHSA-58hv-7753-xmfq, MINI-q9pc-m46g-3g67, PYSEC-2026-3630, UBUNTU-CVE-2026-12482.