Most recent entries from all

CVE-2026-34726 — Copier `_subdirectory` allows template root escape via parent-directory traversal

Affected: copier-org copier

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.

GHSA-85v3-4m8g-hrh6 — Copier `_subdirectory` allows template root escape via parent-directory traversal

Affected: PyPI: copier

### Summary

Copier's `_subdirectory` setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as `..` and uses it directly when selecting the template root.

As a result, a template can escape its own directory and make Copier render files from the parent directory without `--UNSAFE`.

### Details

The relevant code path is:

1. the template defines `_subdirectory` 2. Copier renders that string 3. `template_copy_root` returns `self.template.local_abspath / subdir` 4. Copier walks that directory as the template root

Relevant code:

- <https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/copier/_main.py#L1056-L1062> - <https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/copier/_template.py#L504-L513>

The effective sink is:

```python subdir = self._render_string(self.template.subdirectory) or "" return self.template.local_abspath / subdir ```

There is no check that the resulting path stays inside the template directory.

The documentation for `_subdirectory` describes it as:

> Subdirectory to use as the template root when generating a project.

and explains it as a way to separate template metadata from template source code:

<https://github.com/copier-org/copier/blob/7aa7021bd73797c982492bac3535515d4484fdb7/docs/configuring.md#L1582-L1646>

That description fits values like `template` or `poetry`, but not `..`.

### PoC

#…

PYSEC-2026-2134

Affected: PyPI: copier