CVE-2026-34726: medium-severity vulnerability in copier-org copier
Copier `_subdirectory` allows template root escape via parent-directory traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.4%
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
copier-org · copierRelated CVEs — copier-org copier
In the same product, most dangerous first.
CVE-2026-62999HIGHCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)EPSS 0.4%CVE-2026-34730MEDIUMCopier `_external_data` allows path traversal and absolute-path local file read without unsafe modeEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2025-55214MEDIUMCopier safe template has filesystem write access outside destination pathEPSS 0.3%CVE-2026-53951HIGHCopier: trust-prefix bypass via path traversal runs tasks unpromptedEPSS 0.3%CVE-2025-55201HIGHCopier safe template has arbitrary filesystem read/write accessEPSS 0.3%