What’s Vulnerable › Vulnerabilities

CVE-2026-109596: Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-59

Description

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

Affected products

• gohugoio hugo: from 0.162.0 before 0.167.0 — fixed in 0.167.0

How to fix

Upgrade to a fixed version: gohugoio hugo 0.167.0. Check the vendor advisory for mitigations.

References

• https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
• https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor

Get alerted when CVE-2026-109596 or the next vulnerability affects your stack