CVE-2026-34730

MEDIUM EPSS 20.4%
Published Apr 2, 20263mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Apr 2, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
20.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
copier-orgcopier* <9.14.1

References 3

  • github.com https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b
    Patch
  • github.com https://github.com/copier-org/copier/releases/tag/v9.14.1
    Release Notes
  • github.com https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b
    Patch