CVE-2026-109595 in Hugo
Summary
by MITRE • 10/13/2026
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within Hugo versions prior to v0.167.0 represents a critical path traversal flaw rooted in the asset processing pipeline, specifically affecting the ESBuild integration used for bundling JavaScript and CSS assets. This security issue manifests when utilizing the js.Build, js.Batch, or css.Build functions, which rely on an external dependency resolver known as ESBuild to locate and bundle imported modules. The core technical failure lies in how Hugo handles relative imports and symbolic links during this resolution phase. When a theme or module includes files that reference other resources using relative paths, Hugo passes these instructions to the underlying bundler. However, due to insufficient validation of path boundaries, an attacker can craft inputs containing sequences such as dot-dot-slash (../) or utilize symlinks that point outside the designated project root directory. This allows the build process to traverse up the file system hierarchy and access arbitrary files on the host machine that are readable by the user account executing the Hugo build command.
From a technical perspective, this vulnerability exploits the trust relationship between the static site generator and its asset bundler. ESBuild is designed for performance and flexibility in modern web development, often resolving imports dynamically based on file system structure. In the context of Hugo, themes and modules are expected to be self-contained within their respective directories. The flaw occurs because the fallback resolver does not strictly enforce a chroot-like environment or validate that all resolved paths remain within the project's root directory before passing them to ESBuild. Consequently, if a malicious theme author includes a JavaScript file with an import statement pointing to ../../etc/passwd or similar system files, Hugo will process this request without raising an error, resulting in the contents of those external files being bundled into the final output artifacts. This behavior effectively bypasses the isolation mechanisms intended to keep project assets separate from the broader operating system filesystem.
The operational impact of this vulnerability is severe, particularly for users who generate static sites using themes or modules sourced from untrusted third parties. An attacker with control over a theme's source code can exfiltrate sensitive configuration files, environment variables stored in local dotfiles, database credentials, private keys, or other proprietary data residing on the server where Hugo is executed. Since the vulnerability affects both JavaScript and CSS bundling, it provides multiple vectors for exploitation depending on how the target site utilizes assets. The extracted information could be embedded directly into the generated HTML, served via a custom endpoint if configured to do so, or simply made available through the public web root if the attacker can manipulate the output structure. This constitutes a significant data leakage risk that compromises the confidentiality of the hosting environment and potentially leads to further compromise if sensitive credentials are exposed.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it allows an actor to access files outside the restricted directory through path manipulation. Additionally, from a tactical perspective related to the MITRE ATT&CK framework, this behavior facilitates Data Staged and Collection activities where sensitive information is gathered for later exfiltration. The attack vector leverages the legitimate functionality of asset bundling, making it difficult to detect via simple signature-based monitoring without deep inspection of build logs or file access patterns.
Mitigation strategies primarily involve upgrading Hugo to version v0.167.0 or later, where this path traversal issue has been addressed through stricter validation of resolved paths during the ESBuild integration phase. For environments that cannot immediately upgrade, administrators should enforce strict controls on which themes and modules are permitted for use in production builds. It is advisable to audit all third-party dependencies for any suspicious import statements or symlink structures before inclusion. Furthermore, running Hugo with restricted file system permissions can limit the scope of potential data exposure; by ensuring the build user has minimal read access limited strictly to the project directory, even if a traversal occurs, the attacker may only be able to access files within that constrained boundary rather than sensitive system-wide resources. Regularly reviewing and validating theme sources for security best practices remains essential in maintaining the integrity of static site generation pipelines.