Copier's safe template has filesystem write access outside destination path
Date: 2025-08
Affected: pip/copier
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-55214
CWE: CWE-22

### Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use [unsafe](https://copier.readthedocs.io/en/stable/configuring/#unsafe) features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write files outside the destination path where a project shall be generated or updated. This is possible when rendering a [generated directory structure](https://copier.readthedocs.io/en/stable/configuring/#generating-a-directory-structure) whose rendered path is either a relative parent path or an absolute path. Constructing such paths is possible using Copier's builtin `pathjoin` Jinja filter and its builtin `_copier_conf.sep` variable, which is the platform-native path separator. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc. #### Write access via generated relative path Reproducible example: ```shell echo "foo" > forbidden.txt mkdir src/ echo "bar" > "src/{{ pathjoin('..', 'forbidden.txt') }}" uvx copier copy src/ dst/ cat forbidden.txt ``` #### Write access via generated absolute path Reproducible example: - POSIX: ```shell # Assumption: The current working directory is `/tmp/test-copier-vulnerability/` echo "foo" > forbidden.txt mkdir src/ echo "bar" > "src/{{ pathjoin(_copier_conf.sep, 'tmp', 'test-copier-vulnerab


Mitigations:

Architectural layers (MAESTRO):