EUVD-2026-87665
GHSA-m29q-9cm9-wcf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish malicious theme/module with symlinked mount root
-
DeliveryVictim vendors theme into themes/
-
ExploitVictim runs Hugo build
-
ExecutionSymlink confinement check bypassed at mount root
-
PersistFiles behind symlink read via resources.Get/Match
-
ImpactSensitive host files published to public/
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires that the site being built includes an attacker-controlled theme placed under themes/ or a vendored (non-Go-modules) module that contains a symlink AT a mount root (e.g. themes/mytheme/assets -> /some/dir/outside), and that the operator runs a Hugo build (versions after v0.123.0 and before v0.166.0). Key limiting factors: modules fetched via Go modules are NOT affected because Go module zips cannot contain symlinks; this is NOT an escalation for the main project, which may already legitimately mount absolute paths by configuration; and exploitation depends on the operator adopting/vendoring an untrusted theme or module and executing a build - it is not exploitable against a running site or default first-party project. Impact is limited to disclosure (reading/publishing files behind the symlink); no integrity or availability impact is described. |
| Impact | The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, 8.7 High) presents this as a remote, unauthenticated, no-interaction confidentiality breach, but the description contradicts the UI:N/PR:N framing: exploitation requires a site operator to check a malicious theme into themes/ or add a vendored (non-Go-modules) module containing a symlink at a mount root, then run a Hugo build. That is a supply-chain / build-time trust decision, not a network attack against a running service - so the effective attack requires operator interaction (adding an untrusted theme/module) and the impact is confined to files readable by the build process, which are then published to public/. Signals: no EPSS score, no CISA KEV listing, and no public PoC are provided, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The description also explicitly notes this is NOT an escalation for the main project (which may already mount absolute paths by configuration) and that Go-module-fetched dependencies are immune. Net: the raw 8.7 overstates real-world urgency - the confidentiality impact is real (local build-host file disclosure) but is strongly gated by the requirement to build with an attacker-controlled non-Go-module theme, making this a moderate, conditionally-exploitable issue rather than a drop-everything priority. |
| Exploit ScenarioDerived | An attacker publishes an attractive Hugo theme (or a vendored module) to a public repository with a symlink placed at a mount root, e.g. themes/mytheme/assets -> /etc or -> a directory holding secrets on the build host. A developer clones the theme into themes/ and runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Symlink-following flaws in Hugo's theme and module mount confinement allow files outside a project's mount roots to be read during a site build and, via static mounts, published into the public/ output directory. The flaw affects Hugo builds after v0.123.0 and before v0.166.0 for any project that adopts an untrusted theme checked into themes/ or a vendored (non-Go-modules) module containing a symlink at a mount root and then runs a build; the vendor scores this 8.7 (High) under CVSS 4.0, while independent analysis models it as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N because the site operator must first adopt the malicious theme and execute the build. No public exploit code identified at time of analysis and no KEV listing; a vendor-released patch exists in v0.166.0.
RemediationAI
Vendor-released patch: Hugo v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules - upgrading is the only complete fix and should be applied to any build pipeline running a version after v0.123.0 and before v0.166.0. If an immediate upgrade is not possible, the vendor workaround is to inspect themes/ and vendored (non-Go-modules) modules for symlinks located at mount roots before every build and remove or replace them, substituting an explicit mount entry in the site configuration; the trade-off is that legitimate symlink-based layouts must be rewritten and the check must be repeated whenever themes or vendored modules change, since it is manual and not enforced by the tool. A stronger structural alternative is to deliver themes as Go modules, whose zips cannot carry symlinks and are therefore unaffected, at the cost of repackaging the theme. Because exploitation derives from building an untrusted theme, running builds in a sandbox or container without access to sensitive host paths reduces what can be disclosed, and reviewing the generated public/ tree for unexpected files can detect a successful traversal, though neither compensates for patching and the sandbox route can break builds that legitimately need host resources. Consult the vendor advisory at https://github.com/gohugoio/hugo/security/advisories/GHSA-797m-7j5g-3rpr and the VulnCheck advisory at https://www.vulncheck.com/advisories/hugo-before-0.166.0-path-traversal-via-symlinked-mount-roots for the authoritative fixed version and workaround detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-59 (Improper Link Resolution Before File Access, commonly 'link following'): Hugo's module mount confinement validated mount sources but stopped checking at the mount root itself, so a symlink placed at the mount root - e.g. themes/mytheme/assets -> /some/dir/outside - was traversed rather than rejected. Files behind such a symlink could be read during a build through resources.Get, resources.Match and similar resource functions, and could be written into public/ through static mounts, defeating the rule that theme and module mount sources must be local paths. Two structural limits constrain reach: modules fetched via Go modules are not affected because Go module zips cannot encode symlinks, and this is not an escalation for the main project, which may already legitimately mount absolute paths by configuration. Exploitation further depends on the operator adopting or vendoring a hostile theme/module and then running a build, so it is not exploitable against a running site or a default first-party project, and the impact described is disclosure only (no integrity or availability impact per the vendor vector, and confidential-only scope in the independent assessment's S:C/C:H/I:N/A:N). The fix in v0.166.0 treats symlinked mount roots and symlinked directories between the mount root and the module directory as non-existent for all modules. CPE cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* identifies the product, and ENISA EUVD-2026-87665 lists the affected range as 'hugo 0 <0.166.0'. Some feeds tag this issue 'Authentication Bypass', but the actual mechanism is host-file disclosure via symlink traversal at a trusted mount root, not an authentication bypass.
Know when Hugo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Attacker delivers a malicious theme (AV:N) but the operator must vendor it and run a build (UI:R); reading files outside Hugo's mount confinement crosses a trust boundary (S:C) with confidentiality-only impact (C:H, I/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.
Technical POC Analysis
Evidence note: the supplied material is the GitHub advisory text plus CVE metadata.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations using Hugo static site generator versions after 0.123.0 and before 0.166.0 with untrusted third-party themes or vendored modules are at risk of exposing sensitive files outside the project directory in their published websites. This could lead to unintended disclosure of configuration data or internal documents, potentially damaging customer trust and regulatory compliance. While no public exploit has been identified at time of analysis, leadership should prioritize patching to v0.166.0 to mitigate potential data leakage.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is rem
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attack
Arbitrary file read in Hugo v0.161.0 through v0.165.0 allows an attacker who can contribute content to a Hugo project -
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can s
Local file disclosure in Hugo v0.162.0 through v0.166.x allows an attacker-controlled theme or module to place a symlink
Path traversal in Hugo's asset pipeline lets a malicious theme or module bundle files from outside the project root into
Path traversal in Hugo's css.Sass transpilation pipeline (all versions before v0.167.0) lets a malicious theme or module
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local moun
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrar
Exploit-DB