CVE-2026-34730 Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode
A malicious template can read arbitrary local YAML files and expose their contents in rendered output, affecting users of the Copier library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34730?
CVE-2026-34730 is a medium-severity path traversal vulnerability in copier-org copier, published on 2 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-34730?
3 open source packages ship an affected version, including copier. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
copier PyPI | All versions | 9.14.1 |
copier PyPI | All versions | 9.14.1 |
copier PyPI | All versions | 9.14.1 |
Products include Copier-Org Copier.
How do I fix CVE-2026-34730?
Upgrade copier to 9.14.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-34730 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34730 exists.
Other vulnerabilities in copier-org copier
- CVE-2026-23986 Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
- CVE-2026-23968 Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
- CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal
Sources
Also known as GHSA-hgjq-p8cr-gg4h, PYSEC-2026-2135.