CVE-2026-109595
5.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality
- Weakness
- CWE-22
Impact
Attackers who provide malicious Hugo themes or modules can read arbitrary files accessible to the build user by bundling them into published CSS or JavaScript output. This requires tricking a user or CI pipeline into building a site with the untrusted component.
Root cause
ESBuild's fallback resolver in js.Build, js.Batch, and css.Build fails to prevent path traversal when processing relative imports or symlinks that point outside the project root.
Affected systems
Hugo v0.84.0 before v0.167.0
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Hugo to version v0.167.0 or later. If upgrading is delayed, audit and remove untrusted third-party themes, modules, or assets from your build pipeline.
$ hugo versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.