Hugo CVE-2026-109596

Exploitation requires the victim to install and build with an attacker-controlled Hugo theme or module (v0.162.0 through v0.166.x), and the attacker must place a symlink or NTFS junction at a virtual ancestor directory of a nested mount so that resources.Match follows it during a build. Limiting factors: this is local/build-time only (AV:L) and requires active user interaction (UI:A) - specifically the deliberate adoption and build of an untrusted third-party theme/module; it is not remotely triggerable against a running site, and impact is confined to disclosure of files readable by the build process on the build host.

This is a moderate, conditional risk rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:A/VC:H) is internally consistent with the description: exploitation is local and requires active user interaction (the victim must install an attacker-controlled theme/module and run a Hugo build), yielding high confidentiality impact but no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or widespread exploitation - consistent with a supply-chain/trust-abuse flaw that depends on a developer voluntarily using a malicious theme. The key tension is between the PR:N rating (no authentication needed) and the real-world precondition that the attacker must first get their malicious theme/module adopted and built by the target; CVSS captures this via UI:A and AV:L rather than PR, which is technically correct but understates the social-engineering/supply-chain barrier. Net: a legitimate issue to patch in CI/build pipelines that consume third-party Hugo themes, but not an internet-facing, mass-exploitable vulnerability.

An attacker publishes or compromises a Hugo theme/module and plants a symlink or NTFS junction at a virtual ancestor directory of a nested mount. A developer who adds that theme and runs a Hugo build (v0.162.0-0.166.x) triggers resources.Match, which follows the link and reads/publishes files from outside the theme root - potentially leaking secrets, credentials, or source from the build host into the generated site. No public exploit code is identified in the provided data.