CVE-2026-34730CWE-22

Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

Medium · published April 2, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-02T18:09Z
EPSS history
Timeline
  • 02 APR 18:09Z
    Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode
    cvelistv5