CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295
https://github.com/copier-org/copier/releases/tag/v9.17.0
https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch
https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Copier es una biblioteca y aplicación CLI para renderizar plantillas de proyecto. Desde la versión 9.5.0 hasta la 9.16.0, los segmentos de directorio padre codificados por porcentaje o los separadores de ruta codificados en una URL de plantilla pueden coincidir con un prefijo de repositorio de confianza configurado antes de que un servidor HTTP o un transporte Git decodifique la ruta, permitiendo que características de plantilla inseguras de un repositorio fuera del prefijo de confianza se ejecuten después de la interacción del usuario. Este problema está solucionado en la versión 9.17.0.

Information

Published : 2026-07-31 20:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-62999

Mitre link : CVE-2026-62999

CVE.ORG link : CVE-2026-62999

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

{"id": "CVE-2026-62999", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62999", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T19:59:06.929791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "copier-org", "product": "copier", "versions": [{"status": "affected", "version": ">= 9.5.0, <= 9.16.0"}]}]}], "published": "2026-07-31T20:16:53.523", "references": [{"url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295", "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/releases/tag/v9.17.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "source": "security-advisories@github.com"}, {"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-180"}]}], "descriptions": [{"lang": "en", "value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."}, {"lang": "es", "value": "Copier es una biblioteca y aplicaci\u00f3n CLI para renderizar plantillas de proyecto. Desde la versi\u00f3n 9.5.0 hasta la 9.16.0, los segmentos de directorio padre codificados por porcentaje o los separadores de ruta codificados en una URL de plantilla pueden coincidir con un prefijo de repositorio de confianza configurado antes de que un servidor HTTP o un transporte Git decodifique la ruta, permitiendo que caracter\u00edsticas de plantilla inseguras de un repositorio fuera del prefijo de confianza se ejecuten despu\u00e9s de la interacci\u00f3n del usuario. Este problema est\u00e1 solucionado en la versi\u00f3n 9.17.0."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}