Hugo CVE-2026-100693

Requires that a Hugo build (v0.162.0-<v0.166.0) invokes resources.GetRemote with a URL an attacker can influence (untrusted content, data files, or shortcode/parameter input processed at build time), AND that the operator relies on a security.http.urls IP-literal deny rule as an SSRF mitigation. The bypass is triggered simply by supplying a mixed-case URL scheme (e.g. 'HTTP://' or 'Http://') so the case-sensitive deny match fails. Limiting factors: this is a build-time (local, AV:L) issue, not a live network service, so it is not exploitable against a served static site; it only matters where builds process untrusted input and depend on the deny rule. Sites that never call resources.GetRemote, or do not use the IP-literal deny rule, are unaffected.

This is a security-control bypass (CWE-178, improper case-sensitivity handling) that defeats Hugo's security.http.urls IP-literal deny rule, effectively re-enabling SSRF via resources.GetRemote. The vendor CVSS 4.0 score is 8.6 (HIGH), but several signals argue for a lower real-world priority. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input - exploitation status is unproven. The vendor's own vector is AV:L (local attack vector), which is consistent with Hugo being a build-time static-site generator rather than a running network service; this contradicts the 'network SSRF' mental model and means an attacker must first get influence over content/templates/data consumed by a build. The vendor also rated VI:H and VA:H (integrity and availability HIGH), which appears generous: resources.GetRemote performs an HTTP GET-style fetch, so the realistic technical impact is confidentiality/information disclosure (reading localhost or internal endpoints), not write or destruction. Net: a legitimately real bypass worth patching, but it is a defense-in-depth failure gated on untrusted content reaching a build AND an operator relying on the deny rule as their SSRF mitigation - not a wormable, internet-facing critical.

A site operator configures security.http.urls with an IP-literal deny rule to stop templates from fetching internal/localhost URLs, then builds a site that includes attacker-influenced content (e.g. a community contribution, a data file, or a shortcode parameter) reaching resources.GetRemote. The attacker supplies a URL with a mixed-case scheme such as 'HTTP://127.0.0.1/...', which the case-sensitive deny check fails to match, so Hugo fetches the restricted internal resource and embeds/exposes its contents in the build. No public exploit code was identified at time of analysis; the technique itself (case-swapping the scheme) is trivial to reproduce.