EUVD-2026-76070
GHSA-8jx9-m62j-qx3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation depends on the site author incorporating an attacker-controlled symlink (UI:R); impact is file-content disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place - or who convinces a site author to place - a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
AnalysisAI
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker to place, or to convince the site author to place, a symlink inside a directory mounted into the Hugo project (for example a locally vendored theme under themes/), and requires the site to use a direct-lookup function such as resources.Get or os.ReadFile against that path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) overstates real-world impact: the described behavior is file-content disclosure into the built site, which is a confidentiality issue - there is no described integrity or availability impact, so VI:H/VA:H appear inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Hugo to v0.165.0 or later, which drops symlinks in parent directories during direct resource lookups. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately halt all deployments using Hugo versions 0.124.0-0.164.x to production environments and audit recent builds for unexpected file inclusions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is rem
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can s
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local moun
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrar
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileg
Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block pol
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today