CVE-2026-109574

5.5Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.5Medium

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality
Weakness: CWE-22

Impact

Attackers providing malicious themes or modules can read arbitrary local files from the build system into published CSS output. This requires tricking a user or CI runner into building a site with untrusted stylesheets.

Root cause

A path traversal flaw in css.Sass allows the Sass compiler's import fallback mechanism to resolve files outside the project root via relative, absolute, or symlinked @import and @use rules.

Affected systems

Hugo versions prior to v0.167.0

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Hugo to version v0.167.0 or later. If upgrading is delayed, audit theme and module dependencies to prevent building sites with untrusted Sass files.

shell

$ hugo version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109574