PT-2025-33669 · Copier · Copier

Sisp · Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-55214

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Copier versions 7.1.0 through 9.9.0

Description: Copier, a library and CLI application for rendering project templates, allows for the potential to write files outside the intended destination path when rendering a generated directory structure using relative parent paths or absolute paths. This is possible through the use of the pathjoin Jinja filter and the copier conf.sep variable, enabling a malicious template author to overwrite arbitrary files based on the user's write permissions.

Recommendations: Update to Copier version 9.9.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-55214

GHSA-P7Q8-GRRJ-3M8W

Affected Products

Copier

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55214.json · Exploit
• https://osv.dev/vulnerability/GHSA-p7q8-grrj-3m8w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55214 · Security Note
• https://github.com/copier-org/copier · Note
• https://github.com/copier-org/copier/security/advisories/GHSA-p7q8-grrj-3m8w · Note
• https://github.com/copier-org/copier/commit/fdbc0167cc22780b497e4db176feaf6f024757d6 · Note
• https://twitter.com/CVEnew/status/1957485512538898550 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957505876899610967 · Twitter Post
• https://t.me/CVEtracker/30287 · Telegram Post