# CVE-2026-62999: Copier path traversal trust bypass via encoded URLs

Source: https://junglewise.ai/threats/cve-2026-62999-copier-path-traversal-trust-bypass-via-encoded-urls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-62999 · Severity: high · CVSS 7.5 · Published 2026-07-31

Copier is a tool used by developers to generate and update project structures from templates. A security flaw allows a specially crafted template URL to bypass "trusted repository" security checks by using encoded characters (like %2e%2e for ".." ). If a user is tricked into using or updating a project from such a URL, the tool may automatically execute malicious scripts or commands embedded in the untrusted template without the user's explicit permission.

## Quick answers

**Is CVE-2026-62999 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62999 being exploited in the wild.

**How severe is CVE-2026-62999?** High severity, with a CVSS score of 7.5, published 31 July 2026.

**Which products and versions are affected?** copier-org Copier >= 9.5.0, <= 9.16.0.

**Is there a fix for CVE-2026-62999?** A patch was published on 2026-07-13: Version 9.17.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62999 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62999?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in Copier's trust-prefix validation logic due to incorrect behavior order (validate before canonicalize). The application compares a template URL against a list of trusted prefixes before decoding percent-encoded characters (e.g., '%2e%2e' for '..'). Consequently, a malicious URL can appear to reside within a trusted prefix during the security check, but resolve to an untrusted external repository when fetched by the Git transport or HTTP server. An attacker can leverage this to execute unsafe template features, such as arbitrary shell tasks or Jinja2 extensions, with the permissions of the Copier process. This requires the user to interact with a crafted URL or update a project containing a malicious source path in its configuration. The issue is resolved in version 9.17.0 by decoding URL paths before resolving dot segments during the trust check.

## Affected products

- copier-org Copier >= 9.5.0, <= 9.16.0

## Timeline

- 2026-07-13: patched: Version 9.17.0 released
- 2026-07-15: disclosed: GitHub Security Advisory published
- 2026-07-31: advisory: NVD published CVE-2026-62999

## References

- [https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295](https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295)
- [https://github.com/copier-org/copier/releases/tag/v9.17.0](https://github.com/copier-org/copier/releases/tag/v9.17.0)
- [https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch](https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch)