gohugoio Hugo up to 0.163.0 Virtual Filesystem fs/rootmappingfs.go statRoot somefile symlink

Summaryinfo

A vulnerability classified as problematic has been found in gohugoio Hugo up to 0.163.0. The impacted element is the function statRoot of the file fs/rootmappingfs.go of the component Virtual Filesystem. Performing a manipulation of the argument somefile results in symlink. This vulnerability is known as CVE-2026-58403. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in gohugoio Hugo up to 0.163.0. This affects the function statRoot of the file fs/rootmappingfs.go of the component Virtual Filesystem. The manipulation of the argument somefile with an unknown input leads to a symlink vulnerability. CWE is classifying the issue as CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. This is going to have an impact on confidentiality. The summary by CVE is:

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-58403 since 06/30/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.163.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• gohugoio

Name

• Hugo

Version

• 0.163

Website

• Product: https://github.com/gohugoio/hugo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion