copier up to 9.11.1 _preserve_symlinks

Summaryinfo

A vulnerability categorized as critical has been discovered in copier up to 9.11.1. This impacts the function _preserve_symlinks. The manipulation results in symlink. This vulnerability is reported as CVE-2026-23986. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in copier up to 9.11.1. Affected is the function _preserve_symlinks. The manipulation with an unknown input leads to a symlink vulnerability. CWE is classifying the issue as CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write to arbitrary directories outside the destination path by using directory a symlink along with `_preserve_symlinks: true` and a generated directory structure whose rendered path is inside the symlinked directory. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc. Version 9.11.2 patches the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-23986 since 01/19/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 9.11.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• copier

Version

• 9.11.0
• 9.11.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion