CVE-2026-89258: Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-09-11
Weakness: CWE-59

Description

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

Affected products

gohugoio hugo: before 0.165.0 — fixed in 0.165.0

How to fix

Upgrade to a fixed version: gohugoio hugo 0.165.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89258 or the next vulnerability affects your stack