MEDIUM 6.7 NVD
CVE-2026-109596
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
- https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclos
This medium severity vulnerability with a CVSS score of 6.7 was published on 2026-10-12 via NVD.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.