CVE-2026-109596
5.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality
- Weakness
- CWE-59
Impact
Attackers can read and publish arbitrary local build-host files if you build a site using an untrusted Hugo theme or module. The attacker must convince a user or CI pipeline to build a site that includes their malicious theme containing crafted symlinks.
Root cause
Improper link resolution allows symlinks or NTFS junctions placed at virtual ancestor directories in nested mounts to escape their root when matched by resources.Match.
Affected systems
Hugo v0.162.0 before v0.167.0
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Hugo to version v0.167.0 or later. As an interim workaround, do not build sites using untrusted third-party themes or modules.
$ hugo versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.