A path traversal vulnerability in the Copier library allows unauthenticated remote attackers to achieve unauthorized file access and system manipulation.

This vulnerability consists of an improper limitation of a pathname to a restricted directory (CWE-22) combined with incorrect behavior order during validation (CWE-180). An unauthenticated attacker can exploit these flaws to bypass security restrictions during project template rendering.

The ability to perform path traversal poses a significant risk to data integrity and system security. An attacker could potentially read sensitive files or write malicious content to unauthorized locations, leading to full system compromise. With a CVSS score of 7.5, this high-severity flaw requires immediate remediation to prevent potential exploitation.

Immediate Action: Update the Copier library to version 9.17.0 or later to incorporate the necessary security patches.

Proactive Monitoring: Review application logs for unexpected file system access patterns or requests containing directory traversal sequences such as double dots.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the file system permissions available to the process executing the template rendering.

Public Exploit Available: Unknown

Given the potential for total system impact and the existence of a proof-of-concept, organizations should prioritize updating to version 9.17.0 immediately. Failure to patch leaves the environment susceptible to unauthorized file operations that could compromise the entire host system.