All vulnerabilities
CVE-2026-109596GHSA-6c8w-mpp8-9w47

Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

gohugoio hugo
Open in ThreatlineRecord JSON
CVSS
6.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.167.0Fixed versionCVE List
Published12 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

Text from CVE List

Affected versions 2

  • hugoaffected: 0.162.0 before 0.167.0CVE List
  • hugounaffected: 0.167.0CVE List

References 2