CVE-2025-55201: Copier Path Traversal Vulnerability

CVE-2025-55201 Overview

CVE-2025-55201 is a path traversal vulnerability in Copier, a Python library and CLI tool for rendering project templates. Versions prior to 9.9.1 expose pathlib.Path objects in the Jinja rendering context. These objects retain unconstrained I/O methods, allowing a template to read and write arbitrary files on the host filesystem. The flaw breaks the security boundary that is supposed to isolate template logic from filesystem operations. Copier maintainers fixed the issue in version 9.9.1 by casting the exposed path variables to pathlib.PurePath, which lacks I/O capability. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
A malicious or compromised Copier template can read sensitive files such as SSH keys or credentials, and write arbitrary files to disk during project rendering.

Affected Products

Copier library (Python package) versions prior to 9.9.1
Copier CLI tool versions prior to 9.9.1
Projects and CI pipelines that render untrusted Copier templates

Discovery Timeline

2025-08-18 - CVE-2025-55201 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55201

Vulnerability Analysis

Copier renders project scaffolding by evaluating Jinja2 templates against a user-supplied context. The application injects several variables into that context, including path objects representing the template source and destination directories. Prior to version 9.9.1, those variables were instances of pathlib.Path. The Path class exposes I/O methods such as read_text(), write_text(), read_bytes(), write_bytes(), unlink(), and mkdir(). A template author can invoke those methods directly inside a Jinja expression and operate on any path the rendering process can reach. This nullifies the assumption that templates execute in a constrained sandbox limited to string transformation.

Root Cause

The root cause is the use of pathlib.Path for context variables instead of pathlib.PurePath. PurePath provides only pure path manipulation methods such as joining, splitting, and string conversion. Path extends PurePath with concrete filesystem operations. Exposing the concrete subclass to a templating engine that evaluates user-controlled expressions creates a path traversal and arbitrary file I/O primitive [CWE-22].

Attack Vector

Exploitation requires a user to render a malicious Copier template, which aligns with the local attack vector and user-interaction requirement reflected in the CVSS metrics. An attacker publishes a template repository containing Jinja expressions that invoke .read_text() or .write_text() on the exposed path variables. When a victim runs copier copy against that template, the embedded expressions execute under the victim's user account and inherit its filesystem permissions.

python

# Patch from copier/_main.py (commit 3feea3b)
 from filecmp import dircmp
 from functools import cached_property, partial, wraps
 from itertools import chain
-from pathlib import Path
+from pathlib import Path, PurePath
 from shutil import rmtree
 from tempfile import TemporaryDirectory
 from types import TracebackType

The fix imports PurePath and casts the path variables exposed to the Jinja context to PurePath. This strips the I/O methods while preserving path manipulation features that legitimate templates rely on. Source: GitHub commit 3feea3b.

Detection Methods for CVE-2025-55201

Indicators of Compromise

Copier templates containing Jinja expressions that call .read_text(), .write_text(), .read_bytes(), .write_bytes(), .unlink(), or .open() on path variables.
File reads or writes outside the intended destination directory during a copier copy or copier update run.
Unexpected child processes or filesystem activity originating from the Python interpreter executing Copier.

Detection Strategies

Statically scan Copier template repositories for Jinja expressions that invoke filesystem I/O methods on context path variables.
Inspect copier.yml and .jinja template files in third-party repositories before rendering them in developer or CI environments.
Pin the installed Copier version in dependency manifests and alert when a version below 9.9.1 is detected.

Monitoring Recommendations

Log filesystem activity of CI/CD agents and developer workstations during template rendering operations.
Monitor for reads of sensitive paths such as ~/.ssh/, ~/.aws/, and /etc/ during Copier execution.
Track outbound network connections initiated by Python processes following template rendering, which can indicate exfiltration of files read through the vulnerability.

How to Mitigate CVE-2025-55201

Immediate Actions Required

Upgrade Copier to version 9.9.1 or later in all developer environments, build systems, and CI/CD pipelines.
Audit any Copier templates pulled from untrusted or public sources before rendering them.
Rotate credentials such as SSH keys, API tokens, and cloud secrets if a malicious template was rendered on a host containing them.

Patch Information

The vulnerability is fixed in Copier 9.9.1. The fix is implemented in commit 3feea3b and documented in GitHub Security Advisory GHSA-3xw7-v6cj-5q8h. Install the update with pip install --upgrade copier.

Workarounds

Render Copier templates only from trusted, internally maintained sources until upgrading is possible.
Execute copier inside an isolated container or sandbox with no access to credentials or sensitive directories.
Run Copier under a dedicated low-privilege user account that cannot read secrets or write outside the project directory.

bash

# Upgrade Copier to the patched release
pip install --upgrade 'copier>=9.9.1'

# Verify the installed version
copier --version