The vulnerability lies in Copier's handling of safe templates that can exploit directory symlinks when _preserve_symlinks: true. An attacker who can author a template can use a symlinked directory to write files outside the intended destination, effectively overwriting any file the user has permission to modify. This allows arbitrary file creation or modification, potentially compromising configuration files, binaries, or other sensitive resources.

The flaw affects all installations of the Copier library and command‑line application produced by the copier‑org organization running versions prior to 9.11.2. The affected product is the Copier tool; any version older than 9.11.2 is vulnerable.

With a CVSS score of 6.9 the vulnerability is of moderate severity and is unlikely to be widely exploited, as the EPSS score is less than 1% and it is not listed in the CISA KEV catalog. Attackers must supply or control a template; once the malicious template is rendered, contamination occurs in the context of the user running Copier, impacting any files the user can write. The risk includes data tampering, credential leakage, or the introduction of exploitable code if overridden files are later executed.