The vulnerability resides in Keras 3.12.0. When a tar archive is extracted, the library's safety filter does not enforce the same path‑in‑directory check on symlink entries, allowing a crafted archive to create links pointing outside the intended extraction directory. As a result, an attacker can read existing files, overwrite arbitrary files, or escape the extraction sandbox. The weakness is aligned with CWE-22.

The flaw affects the Keras library from keras-team, version 3.12.0. Only this version is listed; no other versions or ranges are indicated. On environments running Python 3.10 or 3.11, the provided filter is the sole defense against tar path traversal.

Based on the description, the vulnerability is limited to tar extraction routines that allow untrusted archives to be processed. The likely attack vector is a local attacker delivering a malicious tar file to an application that extracts archives, as the description indicates that tampering occurs during routine extraction. This inference is drawn directly from the provided description. Remote exploitation could be possible if a server‑side application processes untrusted archives; this possibility is inferred. The CVSS score of 4.2 represents low‑to‑moderate severity, and the EPSS score of < 1 % shows a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the flaw only modifies the extraction logic, the attacker must have write access to the target directory; if the process runs with elevated privileges, the impact could affect the entire filesystem, which is inferred from the nature of the issue described.