CVE-2026-34730

@@ -117,8 +117,8 @@ def __init__(self, *, path: Path) -> None:
 class ForbiddenPathError(PathError):
     """The path is forbidden in the given context."""
 
-    def __init__(self, *, path: Path) -> None:
-        super().__init__(f'"{path}" is forbidden')
+    def __init__(self, *, path: Path, hint: str = "") -> None:
+        super().__init__(f'"{path}" is forbidden' + (f"\n\n{hint}" if hint else ""))
 
 
 class ExtensionNotFoundError(UserMessageError):

@@ -321,14 +321,31 @@ def _render(path: str) -> str:
             with Phase.use(Phase.UNDEFINED):
                 return self._render_string(path)
 
+        def _load_external_data(path: str) -> Any:
+            if (
+                not (
+                    (self.dst_path / (path := _render(path)))
+                    .resolve()
+                    .is_relative_to(self.subproject.local_abspath)
+                )
+                and not self.unsafe
+            ):
+                raise ForbiddenPathError(
+                    path=Path(path),
+                    hint=(
+                        "If you trust this path, you can override the check:\n"
+                        "  - CLI: `--trust`/`--UNSAFE`\n"
+                        "  - API: `trust=True`"
+                    ),
+                )
+            return load_answersfile_data(self.dst_path, path, warn_on_missing=True)
+
         # Given those values are lazily rendered on 1st access then cached
         # the phase value is irrelevant and could be misleading.
         # As a consequence it is explicitly set to "undefined".
         return LazyDict(
             {
-                name: lambda path=path: load_answersfile_data(  # type: ignore[misc]
-                    self.dst_path, _render(path), warn_on_missing=True
-                )
+                name: lambda path=path: _load_external_data(path)  # type: ignore[misc]
                 for name, path in self.template.external_data.items()
             }
         )

@@ -1005,6 +1005,12 @@ strings, where:
     password: "{{ password }}"
     ```
 
+!!! attention "Reading external data from outside subproject root"
+
+    Reading data from outside the subproject root is supported, but only when explicitly
+    enabled with [`--trust`/`--UNSAFE`](#unsafe) (or `unsafe=True` via API) to prevent
+    unauthorized filesystem access.
+
 ### `envops`
 
 - Format: `dict`

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+from contextlib import AbstractContextManager, nullcontext as does_not_raise
 from pathlib import Path
 from textwrap import dedent
 
@@ -9,6 +10,7 @@
 
 import copier
 from copier._user_data import load_answersfile_data
+from copier.errors import ForbiddenPathError
 
 from .helpers import BRACKET_ENVOPS_JSON, SUFFIX_TMPL, build_file_tree, git_save
 
@@ -328,3 +330,98 @@ def test_undefined_phase_in_external_data(
     copier.run_copy(str(src), dst, defaults=True, overwrite=True)
     answers = load_answersfile_data(dst, ".copier-answers.yml")
     assert answers["key"] == "value"
+
+
+@pytest.mark.parametrize(
+    ("unsafe", "expected"),
+    [(False, pytest.raises(ForbiddenPathError)), (True, does_not_raise())],
+)
+@pytest.mark.parametrize("is_absolute", [False, True], ids=["relative", "absolute"])
+def test_external_data_path_outside_destination_root_is_unsafe_on_copy(
+    tmp_path_factory: pytest.TempPathFactory,
+    is_absolute: bool,
+    unsafe: bool,
+    expected: AbstractContextManager[None],
+) -> None:
+    src, dst = map(tmp_path_factory.mktemp, ("src", "dst"))
+
+    project = dst / "project"
+    project.mkdir()
+
+    secret_file = dst / "secret.yml"
+    secret_file.write_text("secret_key: s3cr3t")
+
+    external_data_path = secret_file if is_absolute else Path("..", "secret.yml")
+
+    build_file_tree(
+        {
+            (src / "copier.yml"): (
+                f"""\
+                _external_data:
+                    secret: {external_data_path}
+
+                secret: "{{{{ _external_data.secret.secret_key }}}}"
+                """
+            ),
+            (src / "{{ _copier_conf.answers_file }}.jinja"): (
+                "{{ _copier_answers | to_nice_yaml }}"
+            ),
+        }
+    )
+    git_save(src, tag="v1")
+
+    with expected:
+        copier.run_copy(str(src), project, defaults=True, unsafe=unsafe)
+
+
+@pytest.mark.parametrize(
+    ("unsafe", "expected"),
+    [(False, pytest.raises(ForbiddenPathError)), (True, does_not_raise())],
+)
+@pytest.mark.parametrize("is_absolute", [False, True], ids=["relative", "absolute"])
+def test_external_data_path_outside_destination_root_is_unsafe_on_update(
+    tmp_path_factory: pytest.TempPathFactory,
+    is_absolute: bool,
+    unsafe: bool,
+    expected: AbstractContextManager[None],
+) -> None:
+    src, dst = map(tmp_path_factory.mktemp, ("src", "dst"))
+
+    project = dst / "project"
+    project.mkdir()
+
+    build_file_tree(
+        {
+            (src / "{{ _copier_conf.answers_file }}.jinja"): (
+                "{{ _copier_answers | to_nice_yaml }}"
+            ),
+        }
+    )
+    git_save(src, tag="v1")
+
+    copier.run_copy(str(src), project)
+    assert load_answersfile_data(project).get("_commit") == "v1"
+
+    git_save(project)
+
+    secret_file = dst / "secret.yml"
+    secret_file.write_text("secret_key: s3cr3t")
+
+    external_data_path = secret_file if is_absolute else Path("..", "secret.yml")
+
+    build_file_tree(
+        {
+            (src / "copier.yml"): (
+                f"""\
+                _external_data:
+                    secret: {external_data_path}
+
+                secret: "{{{{ _external_data.secret.secret_key }}}}"
+                """
+            ),
+        }
+    )
+    git_save(src, tag="v2")
+
+    with expected:
+        copier.run_update(project, defaults=True, overwrite=True, unsafe=unsafe)