Read the docs
TI-2026-71361 Aliases CVE-2026-109596GHSA-38r7-h6rh-gjv9

Symlink following in Hugo exposes files outside theme root

Priority LOW 29CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-59 and the CVSS impact.

Summary

Hugo from 0.162.0 before 0.167.0 contains an improper link resolution flaw (CWE-59) in how it handles nested mount ancestor directories. A malicious theme or module can place a symlink or NTFS junction at a virtual ancestor directory, so resources.Match lists and publishes local files outside its root during builds. The attacker needs control of a theme or module, and the victim must build a site that uses it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-08
Fix Partial hugo (gohugoio): 0.167.0Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gohugoiohugo0.162.0 to before 0.167.00.167.0Patch availableCNA
  • hugo Vendorgohugoio Affected 0.162.0 to before 0.167.0 Fixed in 0.167.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*——gohugoio
  • cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:* Versions — — ·gohugoio

Remediation

Hugo 0.167.0 fixes the issue, so upgrade to 0.167.0 or later. Red Hat fixes Red Hat Hardened Images in RHSA-2026:80677. Red Hat lists Red Hat Enterprise Linux 10, Red Hat OpenShift GitOps and Red Hat OpenStack Platform 18.0 as affected without a fix, and its plan for each is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hugo (gohugoio) Fixed in 0.167.0

Red Hat 1 advisory

  • RHSA-2026:80677 Released 2026-10-12 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images hugo-0.167.0-0.2.hum1@aarch64, hugo-0.167.0-0.2.hum1@s390x, hugo-0.167.0-0.2.hum1@src +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    gohugoio hugo 0.167.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-71360 Hugo path traversal in js.Build ESBuild resolver exposes files outside projectPriority LOW 29
    • TI-2026-71359 Path traversal in Hugo css.Sass exposes files outside project rootPriority LOW 29
    • TI-2026-71362 Stored cross-site scripting in Hugo via table of contents heading IDsPriority LOW 22
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat OpenShift GitOpsAffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:80677
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-109596
  2. 2026-10-13 Alias added: GHSA-38r7-h6rh-gjv9
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-10-20 Fix available: RHSA-2026:80677 · Red Hat
  6. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-10-20 CVSS score added · Red Hat

References

Advisory 1

  • TI-2026-60433 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS CVSS 4.0CRITICAL 9.3
  • TI-2026-60432 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get CVSS 4.0CRITICAL 9.3
  • TI-2026-64848 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots CVSS 4.0HIGH 8.7
  • TI-2026-64846 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks CVSS 4.0HIGH 8.7
  • TI-2026-53153 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant CVSS 4.0CRITICAL 9.3
  • TI-2020-16105 Hugo can execute a binary from the current directory on Windows CVSS 3.1HIGH 8.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences