id: PYSEC-2026-2134
published: "2026-04-02T19:21:32.320Z"
modified: "2026-07-13T05:48:21.008558Z"
aliases:
- CVE-2026-34726
- GHSA-85v3-4m8g-hrh6
details: Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
affected:
- package:
    name: copier
    ecosystem: PyPI
    purl: pkg:pypi/copier
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 9.14.1
  versions:
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - "2.3"
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.5.0
  - 2.5.1
  - 3.0.0a3
  - 3.0.0a5
  - 3.0.0a6
  - 3.0.0a7
  - 3.0.0a8
  - 3.0.0b1
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.1.0
  - 3.2.0
  - 4.0.0
  - 4.0.1
  - 4.0.2
  - 4.1.0
  - 5.0.0
  - 5.1.0
  - 6.0.0
  - 6.0.0a0
  - 6.0.0a2
  - 6.0.0a3
  - 6.0.0a4
  - 6.0.0a5
  - 6.0.0a6
  - 6.0.0a7
  - 6.0.0a9
  - 6.0.0b0
  - 6.1.0
  - 6.2.0
  - 7.0.1
  - 7.1.0
  - 7.1.0a0
  - 7.2.0
  - 8.0.0
  - 8.1.0
  - 8.2.0
  - 8.3.0
  - 9.0.1
  - 9.1.0
  - 9.1.1
  - 9.10.0
  - 9.10.1
  - 9.10.2
  - 9.10.3
  - 9.11.0
  - 9.11.1
  - 9.11.2
  - 9.11.3
  - 9.12.0
  - 9.13.0
  - 9.13.1
  - 9.14.0
  - 9.2.0
  - 9.3.0
  - 9.3.1
  - 9.4.0
  - 9.4.1
  - 9.5.0
  - 9.6.0
  - 9.7.0
  - 9.7.1
  - 9.8.0
  - 9.9.0
  - 9.9.1
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/copier-org/copier/releases/tag/v9.14.1
- type: FIX
  url: https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df
- type: EVIDENCE
  url: https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N