[ CVE-2026-109596 · Published 12 Oct 2026 ]
Vulnerability in gohugoio hugo
CVSS 5.5
EPSS <1%No fix listed yet
[ Description ]Official description
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.