CVE-2026-34726
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.
Risk Assessment
An attacker can use a malicious template to read sensitive files outside the template directory, potentially leading to data disclosure.
Recommendation
Upgrade Copier to version 9.14.1 or later.
Original NVD description (English source)
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.