Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
References
| Link | Resource |
|---|---|
| https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df | Patch |
| https://github.com/copier-org/copier/releases/tag/v9.14.1 | Release Notes |
| https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6 | Exploit Vendor Advisory |
| https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6 | Exploit Vendor Advisory |
Configurations
History
03 Apr 2026, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:copier-org:copier:*:*:*:*:*:python:*:* | |
| References | () https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df - Patch | |
| References | () https://github.com/copier-org/copier/releases/tag/v9.14.1 - Release Notes | |
| References | () https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6 - Exploit, Vendor Advisory | |
| First Time |
Copier-org copier
Copier-org |
03 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6 - |
02 Apr 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 19:21
Updated : 2026-06-17 10:39
NVD link : CVE-2026-34726
Mitre link : CVE-2026-34726
CVE.ORG link : CVE-2026-34726
JSON object : View
Products Affected
copier-org
- copier
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')