PT-2026-29671 · Copier · Copier

Evipepota · Published 2026-04-01 · Updated 2026-04-03 · CVE-2026-34730

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Copier versions prior to 9.14.1

Description The external data feature in Copier allows templates to load YAML files using paths controlled by the template. This can allow a malicious template to read YAML-parseable local files accessible to the user running Copier, potentially exposing their contents in the rendered output. The issue occurs because there is no containment check to ensure the resulting path stays within the subproject destination. This allows for parent-directory traversal (e.g., '../secret.yml') and absolute path reads (e.g., '/tmp/secret.yml'). The vulnerability exists even without using the --UNSAFE flag.

Recommendations Update Copier to version 9.14.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-34730

GHSA-HGJQ-P8CR-GG4H

Affected Products

Copier

References · 8

• 🔥 https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h · Exploit
• https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b · Patch
• https://osv.dev/vulnerability/GHSA-hgjq-p8cr-gg4h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34730 · Security Note
• https://github.com/copier-org/copier/releases/tag/v9.14.1 · Note
• https://github.com/copier-org/copier · Note
• https://twitter.com/infoflowcloud/status/2040130069750779907 · Twitter Post
• https://twitter.com/CVEnew/status/2040128808683020429 · Twitter Post