CVE-2026-23986
📋 TL;DR
CVE-2026-23986 is a path traversal vulnerability in Copier project template tool that allows malicious templates to write files outside the intended destination directory. This affects users who generate projects from untrusted templates using Copier versions before 9.11.2. The vulnerability exploits symlink handling with _preserve_symlinks: true to bypass intended security boundaries.
💻 Affected Systems
- Copier
📦 What is this software?
Copier by Copier Org
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file overwrite, including critical system files, configuration files, or user data, potentially leading to privilege escalation or data destruction.
Likely Case
Malicious template overwrites user files, configuration files, or project files, causing data loss, service disruption, or unauthorized code execution.
If Mitigated
Limited impact to files within user's write permissions, potentially causing project corruption but contained to user space.
🎯 Exploit Status
Exploitation requires creating a malicious template with specific symlink configuration. User must process the template, which requires some social engineering or supply chain compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.11.2
Vendor Advisory: https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh
Restart Required: No
Instructions:
1. Update Copier using pip: pip install --upgrade copier==9.11.2
2. Verify installation: copier --version
3. No restart required as Copier is a CLI tool.
🔧 Temporary Workarounds
Avoid untrusted templates
allOnly use templates from trusted sources and verify template contents before processing.
Disable symlink preservation
allAvoid using _preserve_symlinks: true in template configurations.
🧯 If You Can't Patch
- Restrict Copier usage to trusted templates only from verified sources
- Run Copier in isolated containers or sandboxes with restricted file system access
🔍 How to Verify
Check if Vulnerable:
Check Copier version: copier --version. If version is below 9.11.2, system is vulnerable.Check Version:
copier --versionVerify Fix Applied:
Run: copier --version. Verify output shows 9.11.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected project directories
- Copier processing templates with symlink configurations
Network Indicators:
- Downloads of Copier templates from untrusted sources
SIEM Query:
process_name:"copier" AND (file_write_path NOT CONTAINS "/expected/project/path" OR file_write_path CONTAINS "/etc/" OR file_write_path CONTAINS "/home/")