CVE-2026-100693 in Hugo

Resumen

por MITRE • 2026-09-26

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: VulnCheck
• Reservar: 2026-09-26
• Divulgación: 2026-09-26
• Moderación: aceptado
• Artículo: VDB-410729
• CPE: listo
• CWE: CWE-20 (confirmado)
• CVSS: 8.4 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-100693
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100693
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-100693/