CVE-2026-34730

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b	Patch
https://github.com/copier-org/copier/releases/tag/v9.14.1	Release Notes
https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h	Exploit Vendor Advisory
https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:copier-org:copier:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2026-04-02 19:21

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34730

Mitre link : CVE-2026-34730

CVE.ORG link : CVE-2026-34730

JSON object : View

Products Affected

copier-org

copier

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-34730", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34730", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T13:01:09.904637Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "copier-org", "product": "copier", "versions": [{"status": "affected", "version": "< 9.14.1"}]}]}], "published": "2026-04-02T19:21:32.560", "references": [{"url": "https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/releases/tag/v9.14.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1."}, {"lang": "es", "value": "Copier es una biblioteca y una aplicaci\u00f3n CLI para renderizar plantillas de proyecto. Antes de la versi\u00f3n 9.14.1, la caracter\u00edstica _external_data de Copier permite que una plantilla cargue archivos YAML utilizando rutas controladas por la plantilla. Si las plantillas no confiables est\u00e1n dentro del alcance, una plantilla maliciosa puede leer archivos locales analizables por YAML elegidos por el atacante que son accesibles para el usuario que ejecuta Copier y exponer su contenido en la salida renderizada. Este problema ha sido parcheado en la versi\u00f3n 9.14.1."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:copier-org:copier:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "08914294-5C57-49CB-8D05-BBB156C6B8B1", "versionEndExcluding": "9.14.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}