CVE-2026-23968
📋 TL;DR
This vulnerability in Copier allows safe templates to include arbitrary files/directories outside the local template clone location using symlinks with the default '_preserve_symlinks: false' setting. This affects users who generate projects from templates with Copier versions before 9.11.2, potentially leading to unauthorized file access.
💻 Affected Systems
- Copier
📦 What is this software?
Copier by Copier Org
⚠️ Risk & Real-World Impact
Worst Case
An attacker could craft a malicious template that reads sensitive system files or writes to critical directories, potentially leading to data exfiltration or system compromise.
Likely Case
Template creators could inadvertently or maliciously include files outside the intended template scope, leading to unintended file access or modification during project generation.
If Mitigated
With proper template vetting and security controls, the risk is limited to accidental file inclusion rather than malicious exploitation.
🎯 Exploit Status
Exploitation requires creating or modifying a template with symlinks, but the technique is straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.11.2
Vendor Advisory: https://github.com/copier-org/copier/security/advisories/GHSA-xjhm-gp88-8pfx
Restart Required: No
Instructions:
1. Update Copier using pip: 'pip install --upgrade copier>=9.11.2' 2. Verify installation with 'copier --version' 3. Regenerate any projects created with vulnerable versions if using untrusted templates.
🔧 Temporary Workarounds
Set _preserve_symlinks to true
allForce symlink preservation in template configuration to prevent the bypass
Set '_preserve_symlinks: true' in your template's copier.yml
Use only trusted templates
allOnly generate projects from templates you have fully reviewed and trust
🧯 If You Can't Patch
- Only use templates from trusted sources that you have manually reviewed for symlink usage
- Audit all existing templates for symlinks pointing outside template directories
🔍 How to Verify
Check if Vulnerable:
Check if Copier version is below 9.11.2: 'copier --version'Check Version:
copier --versionVerify Fix Applied:
Confirm version is 9.11.2 or higher: 'copier --version' should show >=9.11.2📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns during template rendering
- Symlink resolution errors in Copier logs
Network Indicators:
- N/A - local file system vulnerability
SIEM Query:
Search for process executions of 'copier' with file access patterns to sensitive directories