PT-2026-3872 · Copier · Copier

Cbrown1234 · Published 2026-01-21 · Updated 2026-01-22 · CVE-2026-23986

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Copier versions prior to 9.11.2

Description Copier, a library and CLI app for rendering project templates, allows a malicious template author to overwrite arbitrary files. This occurs because a safe template can write to directories outside the intended destination path by utilizing a symlink with preserve symlinks: true and a generated directory structure where the rendered path resides within the symlinked directory. The exploit is non-deterministic, as Copier uses os.scandir which yields directory entries in an arbitrary order. The issue allows overwriting files based on the user's write permissions.

Recommendations Update Copier to version 9.11.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-23986

GHSA-4FQP-R85R-HXQH

Affected Products

Copier

References · 11

• 🔥 https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23986.json · Exploit
• https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 · Patch
• https://osv.dev/vulnerability/GHSA-4fqp-r85r-hxqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23986 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23986 · Vendor Advisory
• https://github.com/copier-org/copier · Note
• https://github.com/copier-org/copier/releases/tag/v9.11.2 · Note
• https://twitter.com/VulmonFeeds/status/2014189741869072504 · Twitter Post
• https://t.me/CVEtracker/42705 · Telegram Post
• https://twitter.com/CVEnew/status/2014116180626174196 · Twitter Post