EUVD-2026-64775
GHSA-wg2f-v5x6-m39r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring only DNS control and content write access; build trigger constitutes user interaction; scope changes to internal systems; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.
AnalysisAI
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required for exploitation: first, the Hugo site must invoke resources.GetRemote within its templates or shortcodes - deployments that do not use this function for remote fetching are not affected, and this limits exposure to sites with dynamic, externally-sourced content; second, the attacker must have write access to Hugo content that flows into a resources.GetRemote call, specifically front-matter fields or CMS-supplied values that are passed as the URL argument - direct commit access, CMS editor accounts, or pull-request submission rights each satisfy this depending on the deployment model; third, the attacker must control a DNS hostname whose A record resolves to a loopback address (127.0.0.0/8), an RFC 1918 private range, or a link-local cloud-metadata address (169.254.169.254), which is achievable by registering any public domain and setting its A record to a private IP, as most DNS registrars permit this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) reflects network-reachable exploitation with low complexity, no required privilege against Hugo itself, and a scope change into subsequent systems - the SC:H metric capturing SSRF access to internal endpoints beyond the Hugo process, such as cloud instance metadata services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is confirmed in the available reference data; the newest version cited in references is v0.165.0, which falls within the affected range, and no successor release with a fix is identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Hugo deployments to identify instances running versions 0.91.0 through 0.165.0, especially in CI/CD pipelines and those connected to external CMS platforms or content sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is rem
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local moun
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrar
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileg
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block pol
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today