Copier's veilige template heeft willekeurige bestandssysteem lees-/schrijf toegang

The vulnerability stems from insufficient restrictions on filesystem access through Jinja templating within Copier. While Copier attempts to limit file access using {% include ... %}, attackers can exploit custom Jinja extensions or unsafe features to bypass these limitations. This allows for the reading of arbitrary files on the system, potentially exposing sensitive configuration data, source code, or other critical information. The blast radius depends on the permissions of the user running Copier and the files accessible within the system’s filesystem.

Organizations and developers using Copier for project generation, particularly those relying on custom Jinja extensions or templates from untrusted sources, are at risk. Shared hosting environments where multiple users utilize Copier could also be vulnerable if templates are not properly isolated.

• python / project-generator:

import os
import subprocess

def check_copier_version():
    try:
        result = subprocess.run(['copier', '--version'], capture_output=True, text=True, check=True)
        version = result.stdout.strip()
        if version <= '9.9.0':
            print(f"Copier version is vulnerable: {version}")
        else:
            print(f"Copier version is patched: {version}")
    except FileNotFoundError:
        print("Copier is not installed.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking Copier version: {e}")

check_copier_version()

• generic web: Check Copier configuration files for references to custom Jinja extensions or potentially unsafe template features.

1. 2025-08-18Disclosure

   disclosure

1. Gereserveerd2025-08-08
2. Gepubliceerd2025-08-18
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-55201 is to upgrade to Copier version 9.9.1 or later, which addresses the vulnerability. If upgrading immediately is not feasible, restrict the sources from which Copier templates are generated to trusted locations. Disable or remove any custom Jinja extensions or unsafe features that might be present in your Copier templates. Carefully review and audit all templates used by Copier to identify and eliminate potential vulnerabilities. After upgrading, confirm the fix by attempting to access files outside of the intended template subtree.