CVE-2026-34726CWE-22

Copier `_subdirectory` allows template root escape via parent-directory traversal

Medium · published April 2, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-02T18:07Z
EPSS history
Timeline
  • 02 APR 18:07Z
    Copier `_subdirectory` allows template root escape via parent-directory traversal
    cvelistv5