Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-34726 is a low severity vulnerability with a CVSS score of 0.0. No known public exploits at this time.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root.
As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE.
The relevant code path is:
_subdirectorytemplate_copy_root returns self.template.local_abspath / subdirRelevant code:
The effective sink is:
subdir = self._render_string(self.template.subdirectory) or ""
return self.template.local_abspath / subdir
There is no check that the resulting path stays inside the template directory.
The documentation for _subdirectory describes it as:
Subdirectory to use as the template root when generating a project.
and explains it as a way to separate template metadata from template source code:
That description fits values like template or poetry, but not ...
_subdirectory: .. escapes to the parent directorymkdir -p root/template dst
echo 'loot' > root/loot.txt
printf '%s\n' '_subdirectory: ..' > root/template/copier.yml
copier copy --overwrite root/template dst
find dst -maxdepth 3 -type f | sort
cat dst/loot.txt
Expected output includes:
dst/loot.txt
dst/template/copier.yml
loot
This shows Copier is rendering from root/ rather than from root/template/.
If a user runs Copier on an untrusted template, that template can change the effective template root and make Copier render files from outside the intended template directory.
Practical impact:
..--UNSAFEPlease cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.