Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34726 Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as t… https://www.cve.org/CVERecord?id=CVE-2026-34726
Post summary
The snippet identifies CVE‑2026‑34726 affecting the Copier library, noting a documented _subdirectory setting issue, but does not provide PoC, exploit, or patch details.
🚨*CVE* CVE-2026-34726 Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as t… https://www.cve.org/CVERecord?id=CVE-2026-34726 ----- Traducción: CVE-2026-34726 Cop… http://infoflow.cloud`
Post summary
The post lists CVE‑2026‑34726 for the Copier library but offers only minimal context without details on exploitation, patching, or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | copier-org | copier | - | python | - |