CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal
Attackers can use parent-directory traversal in the _subdirectory setting to escape the template root and render files from outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34726?
CVE-2026-34726 is a medium-severity path traversal vulnerability in copier-org copier, published on 2 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-34726?
3 open source packages ship an affected version, including copier. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
copier PyPI | All versions | 9.14.1 |
copier PyPI | All versions | 9.14.1 |
copier PyPI | All versions | 9.14.1 |
Products include Copier-Org Copier.
How do I fix CVE-2026-34726?
Upgrade copier to 9.14.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-34726 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34726 exists.
Other vulnerabilities in copier-org copier
- CVE-2026-23986 Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
- CVE-2026-23968 Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
- CVE-2026-34730 Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode
Sources
Also known as GHSA-85v3-4m8g-hrh6, PYSEC-2026-2134.