CVE-2025-55214: Copier Package Allows Unsafe File Writes Outside Destination Path
Summary
CVE-2025-55214: Copier's safe template has filesystem write access outside destination path. Affects copier versions >= 7.1.0, < 9.9.1. Fixed in 9.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copier is a Python package that facilitates project generation from templates, allowing users to create and manage project structures efficiently. It provides features for customizing project templates and supports safe and unsafe configurations. However, a vulnerability has been identified that allows safe templates to write files outside the intended destination path, posing a risk to file system integrity.
Vulnerability Detail
The vulnerability arises from Copier's handling of template paths. Although Copier suggests that templates marked as safe do not use unsafe features, it is possible for a malicious template author to exploit the pathjoin Jinja filter to create paths that lead to file writes outside the designated project directory. This can result in overwriting arbitrary files on the system, depending on the user's permissions. The issue is exacerbated when the Python optimization flag is used, which disables certain safety checks.
How To Fix
Minimum fixed version
9.9.1
This is the first release that contains the fix.
pip install --upgrade "copier==9.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using templates that utilize the pathjoin Jinja filter to construct paths that could lead to file writes outside the intended directory. Additionally, ensure that you run Copier in an environment where you can monitor and control file writes.
Conclusion
The CVE-2025-55214 vulnerability in the Copier package poses a significant risk by allowing safe templates to write files outside their intended paths. Users are advised to update to the patched version 9.9.1 or later to mitigate this risk. Until then, caution should be exercised when using templates.
See every vulnerability recorded for copier →
FAQ
CVE-2025-55214 is a vulnerability in the Copier package that allows safe templates to write files outside the intended destination path, potentially leading to file system corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is that a malicious template can overwrite important files on the system, which could lead to data loss or system instability.
If you cannot update the package, avoid using templates that could exploit this vulnerability and monitor your file system for any unauthorized changes.
You can find more information about the Copier package and its features on its official documentation site.
References
Related vulnerabilities
Recent vulnerabilities recorded for copier.
