CVE-2026-109574GHSA-3jfr-vjcq-7jvf
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
gohugoio hugo
CVSS
6.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.167.0hugoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.
Text from CVE List
Affected versions 2
- hugoaffected: all versions before 0.167.0CVE List
- hugounaffected: 0.167.0CVE List