Executive brief
Copier's safe template has filesystem write access outside destination path
Affected products
- PyPI copier
Junglewise Threat Intelligence
CVE-2025-55214: PYSEC-2026-1273 - Copier's safe template has filesystem write access outside destination path
CVE-2025-55214 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: copier (PyPI). Vendors: PyPI.
Related threats
- Copier trust-prefix bypass via path traversal in trusted template URLs
- PYSEC-2026-1272 - Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
- PYSEC-2026-1274 - Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
- PYSEC-2026-1271 - Copier's safe template has arbitrary filesystem read/write access
- Copier path traversal and local file disclosure in _external_data