EUVD-2026-76070
GHSA-8jx9-m62j-qx3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious theme with out-of-bounds symlink
-
DeliveryAuthor vendors theme locally under themes/
-
ExploitHugo build calls resources.Get/os.ReadFile
-
ExecutionSymlink followed past project boundary
-
PersistTarget file contents embedded in built site
-
ImpactSensitive data published
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires an attacker to place, or to convince the site author to place, a symlink inside a directory mounted into the Hugo project (for example a locally vendored theme under themes/), and requires the site to use a direct-lookup function such as resources.Get or os.ReadFile against that path. Exploitation is limited by several factors: themes consumed as Go modules fetched from GitHub have symlinks stripped on download and are NOT exploitable; multi-directory walks (e.g. content/asset walking) are NOT affected; the affected version range is strictly after v0.123.0 and before v0.165.0; and the payoff is limited to disclosure of file contents that end up in the built output. |
| Impact | The published CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) overstates real-world impact: the described behavior is file-content disclosure into the built site, which is a confidentiality issue - there is no described integrity or availability impact, so VI:H/VA:H appear inflated. Exploitation is also not truly zero-prerequisite: the attacker must place, or convince a site author to include, a symlink inside a mounted directory, which in practice means a malicious or compromised locally-vendored theme or resource tree rather than a remote unauthenticated hit against a default install. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a real but conditional supply-chain-style risk rather than an internet-facing mass-exploitation threat; teams building sites from untrusted or third-party themes (any organization, from a large enterprise to a mid-sized municipal IT team, that vendors themes locally) should still patch promptly because leaked file contents become publicly published in the generated site. The mitigating fact that GitHub Go-module themes are immune meaningfully narrows the exposed population. |
| Exploit ScenarioDerived | An attacker publishes an attractive Hugo theme that a site author downloads and vendors locally under themes/; the theme contains a symlink pointing to a sensitive file such as ../../.env or /etc/passwd. When the author runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
RemediationAI
Vendor-released patch: upgrade Hugo to v0.165.0 or later, which drops symlinks in parent directories during direct resource lookups. Until you can upgrade, only build sites from trusted sources: prefer themes consumed as Go modules fetched from GitHub (their symlinks are stripped on download and are not affected) over locally vendored themes under themes/, and audit any locally mounted directories for symlinks that resolve outside the project root before running a build (for example scan the working tree with find . -type l). Treat build environments handling untrusted or third-party themes as the primary exposure and rebuild affected sites after patching, since any already-leaked file contents may have been published. Refer to GHSA-vrv5-r5rf-6v4j for authoritative guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hugo (CPE cpe:2.3:a:gohugoio:hugo) is a widely used Go-based static site generator that assembles sites from content, themes, and mounted resource directories. The root cause is CWE-59 (link following / improper link resolution): during direct resource lookups Hugo canonicalized the final path component but failed to reject symlinks in parent directories, so path confinement meant to keep lookups inside the project could be bypassed. When a symlink inside a mounted directory (for example a locally vendored theme under themes/) points outside the project, direct-lookup APIs such as resources.Get and os.ReadFile resolve through it and read the external target. Notably, themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are unaffected, and multi-directory walks (e.g. content/asset walking) already dropped symlinks and are not affected - only the direct-lookup code path is vulnerable.
Know when Hugo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation depends on the site author incorporating an attacker-controlled symlink (UI:R); impact is file-content disclosure only, so C:H with I:N/A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place - or who convinces a site author to place - a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
Technical POC Analysis
The flaw is a symlink confinement bypass, CWE-59 (link following).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Hugo static site generator versions 0.124.0 through 0.164.x contain a critical arbitrary file disclosure vulnerability allowing attackers to read sensitive files outside the project directory through symlink manipulation. Organizations using affected Hugo versions risk exposing configuration files, API credentials, and private data embedded in published static sites. This represents a direct confidentiality threat to any team deploying Hugo-based websites.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforce strict filesystem permissions on all project mounted directories to prevent unauthorized symlink creation; audit and manually remove all symbolic links from the project directory structure; disable resources.Get and os.ReadFile template functions if not essential to site generation; maintain all configuration and secrets outside the Hugo project directory with restricted access controls; implement cryptographic signing or integrity verification of build artifacts; establish monitoring of Hugo's GitHub and security channels for patch announcements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Hugo is a fast and Flexible Static Site Generator built in Go. Rated high severity (CVSS 8.5), this vulnerability is rem
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose
Symlink-following flaws in Hugo's theme and module mount confinement allow files outside a project's mount roots to be r
Arbitrary file read in Hugo v0.161.0 through v0.165.0 allows an attacker who can contribute content to a Hugo project -
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can s
Local file disclosure in Hugo v0.162.0 through v0.166.x allows an attacker-controlled theme or module to place a symlink
Path traversal in Hugo's asset pipeline lets a malicious theme or module bundle files from outside the project root into
Path traversal in Hugo's css.Sass transpilation pipeline (all versions before v0.167.0) lets a malicious theme or module
Symlink traversal in Hugo's virtual filesystem (v0.123.0-v0.163.0) allows a symlink planted inside a theme or local moun
Stored XSS in Hugo's default code-block renderer allows an attacker with Markdown contribution rights to inject arbitrar
Exploit-DB