Path Traversal Vulnerability in Copier Library and CLI Application

CVE-2026-62999

What is CVE-2026-62999?

The Copier library versions 9.5.0 through 9.16.0 contain a path traversal vulnerability that allows crafted template URLs with percent-encoded parent directory segments to match a trusted repository prefix before the server decodes the path. This flaw potentially permits the execution of unsafe template features from repositories outside the designated trusted prefix upon user interaction. Users are highly encouraged to upgrade to version 9.17.0 or later, where this issue has been addressed.

References