CVE-2026-89258 in Hugo
Summary
by MITRE • 09/11/2026
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in Hugo, a popular static site generator written in Go, represents a significant path traversal flaw that undermines the intended security boundaries of file system operations within project directories. This issue specifically affects versions released after v0.123.0 and prior to v0.165.0. The core technical deficiency lies in how Hugo handles direct resource lookups when symlinks are present in parent directories relative to the target files being accessed. In a secure implementation, any attempt to access resources should strictly adhere to the project's root directory or designated safe zones, effectively dropping or resolving symbolic links that point outside these boundaries. However, due to this incomplete fix of previous vulnerabilities, Hugo fails to strip symlinks located in parent directories during direct resource lookups. This oversight allows an attacker who has the ability to place a symlink within a mounted directory, such as under themes/ for locally vendored themes or other included assets, to manipulate file resolution logic.
The operational impact of this vulnerability is severe, primarily manifesting as unauthorized information disclosure through path confinement bypass. When functions like resources.Get and os.ReadFile are invoked by Hugo's build process, they follow the maliciously placed symlink rather than restricting access to files within the project scope. Consequently, sensitive files residing outside the intended project boundaries can be read and subsequently included in the generated static site output. This means that configuration files containing secrets, source code from other projects, or system-level data accessible by the user running Hugo could be exposed publicly on the web server hosting the built site. The attack vector requires either direct access to place a symlink within a mounted directory or social engineering tactics to convince a site author to include such a structure during theme development or asset management. It is important to note that this vulnerability does not affect themes fetched as Go modules from GitHub, as those are stripped of symlinks upon download, nor does it impact multi-directory walks like content/asset walking which utilize different traversal logic unaffected by this specific flaw.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The failure to properly canonicalize paths and resolve symbolic links before performing file operations allows an attacker to escape the restricted directory context. In terms of adversarial tactics, this behavior corresponds to ATT&CK technique T1083: File and Directory Discovery, where an adversary explores the system to locate sensitive information for exfiltration or further exploitation. The vulnerability serves as a follow-up to earlier security advisories GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw, indicating that previous mitigation attempts were incomplete in addressing all vectors of symlink-based path traversal within Hugo's resource handling subsystem.
To mitigate this risk, organizations and developers using affected versions must upgrade to Hugo v0.165.0 or later immediately, as this version contains the necessary code changes to properly drop symlinks during direct resource lookups. For environments where an immediate upgrade is not feasible, manual inspection of theme directories and mounted assets for symbolic links pointing outside the project root can provide a temporary workaround. Developers should also enforce strict input validation on any user-supplied paths used in file operations within their Hugo configurations or custom templates. Additionally, adopting defense-in-depth strategies such as running Hugo build processes with restricted filesystem permissions can limit the impact if an attacker manages to exploit this flaw. Regular auditing of third-party themes and dependencies for unexpected symbolic links is also recommended to prevent similar issues from being introduced into the project structure.