CVE-2026-62999

Received Received - Intake

Copier Path Traversal via Percent-Encoded Segments

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-62999

EUVD

EUVD-2026-51625

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-180	The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Copier library and CLI app for rendering project templates. It allows percent-encoded parent-directory segments or encoded path separators in a template URL to bypass trusted repository prefix checks before decoding. This could enable unsafe template features from untrusted repositories to execute after user interaction.

Detection Guidance

This vulnerability involves percent-encoded path traversal in Copier versions 9.5.0 through 9.16.0. To detect it, check the installed version of Copier using: pip show copier. If the version is between 9.5.0 and 9.16.0, the system is vulnerable. Additionally, review template URLs for percent-encoded parent-directory segments or encoded path separators that could bypass path validation.

Impact Analysis

An attacker could exploit this to run malicious code from a repository outside the trusted prefix. This could lead to unauthorized access, data theft, or system compromise after you interact with a crafted template URL.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution from untrusted repositories, which may result in data breaches or unauthorized access to sensitive information. This could impact compliance with GDPR (data protection) and HIPAA (health data privacy) by exposing personal or protected health information.

Mitigation Strategies

Upgrade the Copier library and CLI app to version 9.17.0 or later to address the vulnerability. Review template URLs for percent-encoded parent-directory segments or encoded path separators that could bypass trusted repository prefixes.

Hi! I’m here to help you understand CVE-2026-62999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70