Arbitrary File Overwrite Vulnerability in Copier Library by Copier Organization

CVE-2026-23986

What is CVE-2026-23986?

The Copier library, which is designed for rendering project templates, contains a vulnerability that allows a malicious template author to overwrite arbitrary files outside the intended directory. Prior to version 9.11.2, although Copier suggests that templates without unsafe features are safe, it has been discovered that using a directory symlink in conjunction with the _preserve_symlinks: true option can lead to severe security risks. By exploiting this flaw, malicious templates can be crafted to write files anywhere the user has write permissions, potentially causing significant disruption or harm. Users are advised to upgrade to version 9.11.2 or later to mitigate this issue.

References