CVE-2026-34726: falha de média gravidade em copier-org copier
Copier `_subdirectory` allows template root escape via parent-directory traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.4%
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
copier-org · copierCVEs relacionadas — copier-org copier
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62999HIGHCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)EPSS 0.4%CVE-2026-34730MEDIUMCopier `_external_data` allows path traversal and absolute-path local file read without unsafe modeEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2025-55214MEDIUMCopier safe template has filesystem write access outside destination pathEPSS 0.3%CVE-2026-53951HIGHCopier: trust-prefix bypass via path traversal runs tasks unpromptedEPSS 0.3%CVE-2025-55201HIGHCopier safe template has arbitrary filesystem read/write accessEPSS 0.3%