Hugo CVE-2026-10582

Three concurrent conditions are required for exploitation: first, the Hugo site must invoke resources.GetRemote within its templates or shortcodes - deployments that do not use this function for remote fetching are not affected, and this limits exposure to sites with dynamic, externally-sourced content; second, the attacker must have write access to Hugo content that flows into a resources.GetRemote call, specifically front-matter fields or CMS-supplied values that are passed as the URL argument - direct commit access, CMS editor accounts, or pull-request submission rights each satisfy this depending on the deployment model; third, the attacker must control a DNS hostname whose A record resolves to a loopback address (127.0.0.0/8), an RFC 1918 private range, or a link-local cloud-metadata address (169.254.169.254), which is achievable by registering any public domain and setting its A record to a private IP, as most DNS registrars permit this. Exploitation is prevented if the build environment enforces network-layer egress controls blocking private ranges, if resources.GetRemote is absent from the site's templates, or if the content submission pipeline enforces URL validation independently of Hugo's allowlist. The CVSS 4.0 PR:N metric indicates no Hugo-level privilege is required, but write access to the content layer is an implicit prerequisite.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) reflects network-reachable exploitation with low complexity, no required privilege against Hugo itself, and a scope change into subsequent systems - the SC:H metric capturing SSRF access to internal endpoints beyond the Hugo process, such as cloud instance metadata services. The UI:P flag requires a build to be triggered after malicious content is introduced, but in CI/CD pipelines that auto-build on content commits, this requirement is largely nominal. No EPSS data was provided for quantitative probability comparison, and this CVE is not listed in the CISA KEV catalog, meaning active exploitation is not confirmed - a meaningful signal that reduces urgency relative to the raw score, though the low operational complexity narrows that gap. Even a mid-sized municipal IT team in rybnik running a Hugo-based public site backed by a cloud CMS would face meaningful risk if their build pipeline executes with access to cloud metadata or internal APIs, because the exfiltration artifact is the published static site itself, not a reverse shell or out-of-band channel. No conflicting signals between CVSS vector and description are present - the network attack vector and changed scope are well-supported by the technical mechanism.

An attacker with write access to a Hugo site's content repository or connected headless CMS submits a front-matter field containing a URL such as http://internal.attacker.com/ pointing to a domain whose DNS A record resolves to 169.254.169.254. When the Hugo site build is triggered - automatically on a content commit in a CI/CD pipeline - resources.GetRemote fetches the cloud instance metadata endpoint, bypassing the security.http.urls allowlist because only the hostname string is checked. The IAM credentials or other sensitive metadata returned are embedded directly into the generated static site pages and published, making the final build artifact itself the exfiltration vehicle.