Medium [CVE-2026-12482] Arbitrary File Operations via Malicious Tar Archive Processing

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`.

Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks.

The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.

A flaw was found in Keras. An attacker can exploit a vulnerability in the tar archive processing to bypass security validations.

This allows for the creation of symbolic links (symlinks) outside of the intended directory, which could lead to unauthorized access to or modification of files on the system, or enable an attacker to navigate beyond restricted directories.

This Moderate vulnerability in Keras, as used in Red Hat OpenShift AI components, allows an attacker to create arbitrary symlinks outside of the intended extraction directory when processing a specially crafted tar archive. Exploitation requires user interaction and has high attack complexity, which reduces the overall risk.