PT-2025-33667 · Copier · Copier

Sisp · Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-55201

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Copier versions prior to 9.9.1

Description: Copier exposes pathlib.Path objects in the Jinja context with unconstrained I/O methods, allowing a safe template to read and write arbitrary files. This renders the security model regarding filesystem access ineffective.

Recommendations: Update to version 9.9.1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-55201

GHSA-3XW7-V6CJ-5Q8H

Affected Products

Copier

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55201.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-55201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55201 · Security Note
• https://osv.dev/vulnerability/GHSA-3xw7-v6cj-5q8h · Vendor Advisory
• https://github.com/copier-org/copier · Note
• https://github.com/copier-org/copier/commit/3feea3b3ff3c20d80cbb16a2f3b9567ffc5606d1 · Note
• https://github.com/copier-org/copier/security/advisories/GHSA-3xw7-v6cj-5q8h · Note
• https://t.me/CVEtracker/30285 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1957518675235258862 · Twitter Post
• https://twitter.com/CveFindCom/status/1957482813134918073 · Twitter Post
• https://twitter.com/CVEnew/status/1957485514510266419 · Twitter Post