CVE-2026-23968

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan UNIX Symbolic Link (Symlink) Following pada copier-org copier. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with `_preserve_symlinks: false` (which is Copier's default setting). Version 9.11.2 patches the issue.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 patch
• https://github.com/copier-org/copier/security/advisories/GHSA-xjhm-gp88-8pfx exploit · advisory pihak ketiga