CVE-2026-34730 Details
Description
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.
A path traversal vulnerability has been identified in the Copier library and CLI application, specifically in versions prior to 9.14.1. The issue arises from the `_external_data` feature, which allows templates to load YAML files using paths controlled by the template. If untrusted templates are used, a malicious template can exploit this feature to read local files chosen by the attacker, including sensitive information, and expose the contents in the rendered output. This vulnerability is particularly concerning because it can be exploited without the `--UNSAFE` flag, which is required for accessing external data paths outside the subproject root. The issue has been patched in version 9.14.1.
Users can update to Copier version 9.14.1 or later, where this vulnerability has been patched. The update is available through the Python Package Index (PyPI).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h | CISA-ADP | ExploitVendor Advisory |
| https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b | [email protected] | Patch |
| https://github.com/copier-org/copier/releases/tag/v9.14.1 | [email protected] | Release Notes |
| https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| copier-org copier | < 9.14.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |