PyPI/copier CVE-2026-34726: medium 4.4, EPSS 0.37%

Copier `_subdirectory` allows template root escape via parent-directory traversal

Action: Upgrade copier to 9.14.1 or later.

pip install copier==9.14.1

Affected

Fixed versions

Sources

• osv: GHSA-85v3-4m8g-hrh6
• https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6
• https://nvd.nist.gov/vuln/detail/CVE-2026-34726
• https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df
• https://github.com/copier-org/copier
• https://github.com/copier-org/copier/releases/tag/v9.14.1

CVE-2026-34726 · published 2026-04-01T22:28:49Z · modified 2026-07-13T07:26:50.377650565Z · JSON