Executive brief
Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
Affected products
- PyPI copier
Junglewise Threat Intelligence
CVE-2026-23986: PYSEC-2026-1272 - Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
CVE-2026-23986 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: copier (PyPI). Vendors: PyPI.
Related threats
- Copier trust-prefix bypass via path traversal in trusted template URLs
- PYSEC-2026-1274 - Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
- PYSEC-2026-1273 - Copier's safe template has filesystem write access outside destination path
- PYSEC-2026-1271 - Copier's safe template has arbitrary filesystem read/write access
- Copier path traversal and local file disclosure in _external_data