Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-34730

22
FAUCET Score

CVE-2026-34730 is a medium-severity vulnerability (CVSS 5.5) affecting copier_org copier versions prior to 9.14.1. This flaw, categorized as CWE-22, allows untrusted templates to leverage the _external_data feature to read and expose attacker-chosen YAML-parseable local files from a user's system. Exploitation requires local access and user interaction, resulting in a high confidentiality impact by disclosing sensitive file contents. Currently, there is no evidence of active exploitation, public exploit code, or significant community attention for this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 9.14.1CPE matchmatch criteria
cpe:2.3:a:copier-org:copier:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.29%
Probability of exploitation in next 30 days
EPSS Percentile
20.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0029 is in the 25th percentile among its peer group of 5,760 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: copierFixed in: 9.14.1

Vendor Advisories (1)

pipGHSA-hgjq-p8cr-gg4hmedium

Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

Apr 1, 2026

References

github.com / copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b
Patch
github.com / copier-org/copier/releases/tag/v9.14.1
Release Notes
github.com / copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h
ExploitVendor Advisory