CVE-2026-62999

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62999", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T23:10:57.032Z", "datePublished": "2026-07-31T19:41:55.494Z", "dateUpdated": "2026-07-31T19:59:30.346Z"}, "containers": {"cna": {"title": "Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-180", "lang": "en", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch"}, {"name": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295", "tags": ["x_refsource_MISC"], "url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295"}, {"name": "https://github.com/copier-org/copier/releases/tag/v9.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/copier-org/copier/releases/tag/v9.17.0"}], "affected": [{"vendor": "copier-org", "product": "copier", "versions": [{"version": ">= 9.5.0, <= 9.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T19:41:55.494Z"}, "descriptions": [{"lang": "en", "value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."}], "source": {"advisory": "GHSA-34mv-rjq9-5mch", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T19:59:06.929791Z", "id": "CVE-2026-62999", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T19:59:30.346Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62999", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T19:59:06.929791Z"}}}], "references": [{"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T19:59:25.678Z"}}], "cna": {"title": "Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)", "source": {"advisory": "GHSA-34mv-rjq9-5mch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "copier-org", "product": "copier", "versions": [{"status": "affected", "version": ">= 9.5.0, <= 9.16.0"}]}], "references": [{"url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "name": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295", "name": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/copier-org/copier/releases/tag/v9.17.0", "name": "https://github.com/copier-org/copier/releases/tag/v9.17.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-180", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T19:41:55.494Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62999", "state": "PUBLISHED", "dateUpdated": "2026-07-31T19:59:30.346Z", "dateReserved": "2026-07-14T23:10:57.032Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-31T19:41:55.494Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "copier", "vendor": "copier-org", "versions": [{"status": "affected", "version": ">= 9.5.0, <= 9.16.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."}, {"lang": "es", "value": "Copier es una biblioteca y aplicaci\u00f3n CLI para renderizar plantillas de proyecto. Desde la versi\u00f3n 9.5.0 hasta la 9.16.0, los segmentos de directorio padre codificados por porcentaje o los separadores de ruta codificados en una URL de plantilla pueden coincidir con un prefijo de repositorio de confianza configurado antes de que un servidor HTTP o un transporte Git decodifique la ruta, permitiendo que caracter\u00edsticas de plantilla inseguras de un repositorio fuera del prefijo de confianza se ejecuten despu\u00e9s de la interacci\u00f3n del usuario. Este problema est\u00e1 solucionado en la versi\u00f3n 9.17.0."}], "id": "CVE-2026-62999", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62999", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T19:59:06.929791Z", "version": "2.0.3"}}]}, "published": "2026-07-31T20:16:53.523", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295"}, {"source": "security-advisories@github.com", "url": "https://github.com/copier-org/copier/releases/tag/v9.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-180"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.5.0,9.16.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "copier", "source": "cna", "vendor": "copier-org"}, "product": "copier", "vendor": "copier-org"}], "created": "2026-07-31T20:30:17.509431+00:00", "updated": "2026-08-02T04:00:06.805271+00:00", "vendors": ["copier-org", "copier-org$PRODUCT$copier"]}