6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23968

CVE-2026-23968: Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with _preserve_symlinks: false (which is Copier's default setting). Version 9.11.2 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23968

CVE-2026-23968:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copier	pip	< 9.11.2	9.11.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in GHSA-xjhm-gp88-8pfx allows a malicious copier template to read arbitrary files on the filesystem. This is possible due to improper handling of symbolic links within the template when the _preserve_symlinks option is set to false (the default setting).

The analysis of the patch commit b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 pinpoints the exact location of the vulnerability. The changes are in the copier/_main.py file, specifically within the _render_template method of the Worker class.

The patch introduces a security check. Before this change, the code iterated through the template files and, when encountering a symlink (and _preserve_symlinks was false), it would resolve the symlink and copy the target file or directory. It did not, however, check if the resolved path of the symlink pointed to a location outside of the intended template source directory.

The added code block explicitly checks for this condition: it verifies if a file is a symlink, if symlinks are not being preserved, and if the resolved path of the symlink is outside the template's local path. If all these conditions are true, it raises a ForbiddenPathError, preventing the file from being copied.

The vulnerable function is therefore Worker._render_template, as it contains the logic that processes the template files and, prior to the patch, improperly handled symlinks, leading to the arbitrary file read. During exploitation, this function would be present in the runtime profile or stack trace as it processes the malicious symlink.

Vulnerable functions

Worker._render_template

copier/_main.py

This function is responsible for rendering the template files. The vulnerability lies in this function where, prior to the patch, it would follow symbolic links without validating if the target of the link was within the template's root directory. When `_preserve_symlinks` is set to `false`, the code resolves symlinks. A malicious template could contain a symlink pointing to a sensitive file outside the template's directory (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). This function would then read and copy the content of that sensitive file into the generated project, leading to an arbitrary file read vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.