CVE-2026-109574 in Hugo
Summary
by MITRE • 10/13/2026
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Hugo versions prior to 0.167.0 represents a critical path traversal flaw within its Sass compilation engine, specifically affecting the css.Sass module. This security issue stems from an insufficient validation of file paths during the processing of import and use directives. When Hugo processes stylesheets written in SCSS or Sass syntax, it relies on the underlying Dart Sass compiler to resolve dependencies. The core technical flaw lies in how the tool handles import fallbacks and relative path resolution. If a theme or module includes stylesheet references that utilize relative paths pointing upwards using dot-dot notation (..), absolute file system paths, or symbolic links targeting locations outside the designated project root directory, Hugo fails to properly sanitize these inputs before passing them to the compiler. This lack of strict boundary enforcement allows the compilation process to traverse beyond the intended sandboxed environment of the static site generation project.
From an operational perspective, this vulnerability enables a malicious actor who controls or influences the theme structure to perform unauthorized file reads on the host system where Hugo is executed. By crafting specific stylesheet files that contain carefully constructed import statements pointing to sensitive configuration files, source code repositories, or other private data residing in parent directories or unrelated parts of the filesystem, an attacker can force the Sass compiler to include these external contents directly into the generated CSS output file. Since static sites are typically served publicly over HTTP/HTTPS, any content compiled into the final CSS becomes accessible to anyone visiting the website. This effectively transforms a server-side processing error into a client-accessible data exfiltration vector, bypassing traditional web application firewalls that might not inspect internal build processes or asset compilation steps in such granular detail.
The impact of this vulnerability is severe as it leads to information disclosure and potential compromise of sensitive system data. Attackers can extract database credentials stored in configuration files, proprietary source code logic from other projects on the same server, or private keys if they are accessible via path traversal. This aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements that can cause paths to traverse outside the intended directory structure. Furthermore, this attack vector is consistent with ATT&CK technique T1083: File and Directory Discovery, as it involves enumerating and accessing files on the local system through application-level logic rather than direct operating system access. The risk is particularly high in shared hosting environments or CI/CD pipelines where Hugo runs with elevated privileges or broad filesystem access to assemble multi-module projects.
To mitigate this vulnerability, organizations must immediately upgrade Hugo to version 0.167.0 or later, as the developers have implemented stricter path validation and sandboxing mechanisms within the Sass integration layer. This update ensures that all import targets are resolved relative to the project root and explicitly rejects any attempts to access files outside of it. Additionally, administrators should audit their themes and modules for any use of absolute paths or excessive parent directory references in stylesheet imports, replacing them with safe, relative pathing conventions. Implementing a content security policy that restricts external script execution can also help reduce the attack surface, although this specific vulnerability is exploited during the build phase rather than at runtime by end-users. Regularly updating static site generator tools and reviewing third-party module dependencies are essential practices to maintain the integrity of web infrastructure against such logic-based traversal attacks.