CVE-2026-34726
2 advisories.
PyPI/copier CVE-2026-34726: medium 4.4
Copier `_subdirectory` allows template root escape via parent-directory traversal
Action: Upgrade copier to 9.14.1 or later.
pip install copier==9.14.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.14.1 | - |
Fixed versions
| 9.14.1 |
Sources
- osv: GHSA-85v3-4m8g-hrh6
- https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6
- https://nvd.nist.gov/vuln/detail/CVE-2026-34726
- https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df
- https://github.com/copier-org/copier
- https://github.com/copier-org/copier/releases/tag/v9.14.1
CVE-2026-34726 · published · modified · JSON
PyPI/copier CVE-2026-34726: medium 4.4
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the cur
Action: Upgrade copier to 9.14.1 or later.
pip install copier==9.14.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.14.1 | - |
Fixed versions
| 9.14.1 |
Sources
- osv: PYSEC-2026-2134
- https://github.com/copier-org/copier/releases/tag/v9.14.1
- https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df
- https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6
CVE-2026-34726 · published · modified · JSON