Is there a patch available for CVE-2026-58403?

Yes, a patch is available for CVE-2026-58403. Update the affected software to the latest version immediately.

Hugo CVE-2026-58403

Q: What is the CVSS score of CVE-2026-58403?

CVE-2026-58403 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41907 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-06 GitHub_M

Information Disclosure Red Hat Suse Hugo Gohugoio

5.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

AT:P (symlink must be pre-planted) maps to AC:H; UI:A to UI:R; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 21:16 EUVD

Analysis Generated

Jul 06, 2026 - 20:08 vuln.today

DescriptionCVE.org

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

AnalysisAI

Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local mount to escape the mount sandbox and return the contents of arbitrary files accessible to the OS user running the hugo build. A regression in RootMappingFs.statRoot introduced a Stat call where Lstat was required, silently resolving symlinks that cross mount boundaries. No public exploit code or CISA KEV listing exists; the issue is fixed in v0.163.1.

Technical ContextAI

Hugo uses an internal virtual filesystem layer called RootMappingFs to enforce sandbox boundaries between declared mount points, ensuring theme or content directories cannot read files outside their configured tree. CWE-59 (Improper Link Resolution Before File Access - 'Link Following') identifies the root cause class: a regression caused the statRoot method to call os.Stat, which transparently follows symbolic links at the OS level, instead of os.Lstat, which returns metadata for the symlink itself without following it. A direct os.ReadFile call on a filename that is a symlink would then resolve outside the mount boundary and return the target file's content. The affected CPE is cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:*, spanning all platforms and build variants from v0.123.0 through v0.163.0. The root-cause commit is confirmed at cf9c8f93ca2a2838ce378f9e36d052ac2f79e229.

RemediationAI

Upgrade Hugo to v0.163.1 or later, available at https://github.com/gohugoio/hugo/releases/tag/v0.163.1, which restores the correct Lstat call and re-establishes the filesystem sandbox. This is a drop-in patch release with no breaking changes per the advisory at https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc. If immediate upgrade is blocked, audit all theme and mount directories for unexpected symbolic links before each build using 'find . -type l' and remove any that point outside the mount tree. As a compensating control, run hugo in a container or chroot with a minimal read-only filesystem overlay so that even a successfully followed symlink cannot reach sensitive files such as SSH keys, cloud credentials, or environment files; note this adds operational overhead. Restricting the OS user running hugo to a low-privilege account with no access to sensitive paths also limits the blast radius. Do not use untrusted third-party themes on affected versions.