CVE-2026-23986

HighPublic PoC

Published: 21 January 2026

Published

21 January 2026

Modified

02 February 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS Score 0.0007 20.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23986 is a high-severity UNIX Symbolic Link (Symlink) Following (CWE-61) vulnerability in Copier-Org Copier. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002) and 1 other technique.

Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

Vulnerability enables malicious template (file) to perform arbitrary file overwrites via symlink abuse when user executes Copier, directly facilitating user execution of malicious content and subsequent stored data manipulation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which…

would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write to arbitrary directories outside the destination path by using directory a symlink along with `_preserve_symlinks: true` and a generated directory structure whose rendered path is inside the symlinked directory. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc. Version 9.11.2 patches the issue.

Deeper analysisAI

CVE-2026-23986 is a vulnerability in Copier, a library and CLI application for rendering project templates, affecting versions prior to 9.11.2. The flaw allows a supposedly "safe" template—one that avoids unsafe features like custom Jinja extensions requiring the --UNSAFE or --trust flags—to write files to arbitrary directories outside the specified destination path. This occurs through the use of a directory symlink, the _preserve_symlinks: true option, and a generated directory structure whose rendered path resolves inside the symlinked directory, linked to CWE-61 (symlink following). The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).

An attacker with local access can exploit this by crafting a malicious template and tricking a user into generating a project from it, as Copier presents it as safe without triggering warnings. No privileges are needed beyond the user's own write permissions, but user interaction is required to run the copier command on the template. Successful exploitation enables overwriting arbitrary files on the system, potentially causing data corruption or disruption depending on the targeted locations and permissions.

The vulnerability is addressed in Copier version 9.11.2, which patches the issue. Security practitioners should upgrade to this version or later. Relevant resources include the GitHub security advisory at https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh, release notes at https://github.com/copier-org/copier/releases/tag/v9.11.2, and the patching commit at https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6.