What is the CVSS score of CVE-2026-12482?

CVE-2026-12482 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-12482?

Yes, a patch is available for CVE-2026-12482. Update the affected software to the latest version immediately.

Keras CVE-2026-12482

Q: Which versions of Keras are affected by CVE-2026-12482?

Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directory escape that can read or overwrite arbitrary files on the host filesystem.. A patch is available.

EUVD-2026-43620 MEDIUM

Path Traversal (CWE-22)

2026-07-14 @huntr_ai

GHSA-58hv-7753-xmfq

Python Path Traversal Red Hat Keras Team Keras Keras Team

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (huntr_ai) PRIMARY

LOW

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

Archive delivered over network (AV:N), victim must extract (UI:R, AC:H), symlinks escape extraction boundary (S:C), enabling file read and overwrite (C:L, I:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 18:07 NVD

LOW MEDIUM

CVSS changed

Aug 06, 2026 - 18:07 NVD

3.1 (LOW) 6.5 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 05:46 vuln.today

CVE Published

Jul 14, 2026 - 05:13 cve.org

LOW 3.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionNVD

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filter_safe_tarinfos validation in keras/src/utils/file_utils.py. Specifically, symlink entries are not subjected to the same is_path_in_dir validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where filter_safe_tarinfos is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.

AnalysisAI

Symlink entries in malicious tar archives bypass the filter_safe_tarinfos validation in Keras 3.12.0, enabling directory escape that can read or overwrite arbitrary files on the host filesystem. The root defect is in keras/src/utils/file_utils.py, where is_path_in_dir path containment checks are applied only to regular file entries - symlink entries are extracted without equivalent validation. The exposure is most severe on Python 3.10 and 3.11, where filter_safe_tarinfos is the sole extraction safeguard; no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Keras (CPE: cpe:2.3:a:keras-team:keras-team/keras:*:*:*:*:*:*:*:*) is a widely used high-level deep learning framework for Python, commonly used to load models and datasets packaged as tar archives. The vulnerability class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), specifically manifesting as a tar-slip via symlink. The affected code iterates archive entries and calls is_path_in_dir to ensure extracted paths stay within the target root - but entries identified as symlinks (tarinfo.issym() or tarinfo.islnk()) are not subjected to this check. A crafted archive can therefore plant a symlink entry whose target resolves to an arbitrary host path (e.g., ../../../../home/user/.ssh/authorized_keys). On Python 3.10 and 3.11, no secondary defense exists in the interpreter's tarfile module; Python 3.12 introduced its own data filter as an independent safeguard. This issue is described as distinct from CVE-2025-12060, suggesting a pattern of incomplete fixes in this code area.

RemediationAI

No vendor-released patch version has been identified at time of analysis; the sole reference is the huntr.com bounty report at https://huntr.com/bounties/5d3638e8-a9f6-4964-a865-ddb9fe4d4b6e. Until a patched Keras release is issued, operators should avoid passing untrusted tar archives to any Keras model-loading or file-utility API. A targeted compensating control for Python 3.10/3.11 environments is to pre-scan archive contents using Python's tarfile module and reject any entry where tarinfo.issym() or tarinfo.islnk() returns True before invoking Keras extraction. Upgrading the runtime to Python 3.12 or later introduces the interpreter-level data filter in tarfile, which provides an independent extraction safeguard; note this reduces but does not guarantee elimination of exposure if Keras's own filter is the triggering code path. Operationally, restrict Keras model loading to archives sourced from trusted, hash-verified origins to eliminate the primary delivery vector.