The vulnerability arises when Copier’s _subdirectory setting, intended to define the template's root, accepts parent-directory traversal sequences such as "..". This causes the tool to resolve outside the intended template directory, allowing it to render files from a parent location without requiring an --UNSAFE flag. The result is the ability to read arbitrary files that the template was not meant to access, constituting a classic path traversal weakness (CWE‑22). The CVSS score of 4.4 indicates a moderate severity impact.

Any installation of the open‑source Copier tool built before version 9.14.1 is affected. The issue exists in both the library and command‑line interface across all operating systems where the tool runs. The problem is addressed in releases 9.14.1 and later, which enforce proper handling of _subdirectory values.

The CVSS metric places the risk in the medium range; no EPSS score is supplied, and the vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list. Exploitation requires an attacker to supply a template configuration containing a malicious _subdirectory value, which is possible when a user retrieves a template from an untrusted source or the template itself embeds the vulnerable setting. Because the attack occurs locally on the system running Copier, the impact is confined to that environment, but the ability to read arbitrary files can be critical, especially if the file contains sensitive data.