CVE-2026-50135 Details
Description
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.
A vulnerability in Hugo, a static site generator, allows for arbitrary file reads through a symlink confinement bypass. This issue affects Hugo versions 0.123.0 to 0.161.1. The vulnerability arises from a regression that caused the file system's statRoot method to follow symlinks, enabling direct resource requests to retrieve contents from files outside the intended directory. This flaw can be exploited by placing a symlink in a local theme directory that points to an accessible file, thereby circumventing Hugo's virtual file system restrictions.
Users can upgrade to Hugo version 0.162.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a | [email protected] | Patch |
| https://github.com/gohugoio/hugo/releases/tag/v0.162.0 | [email protected] | ProductRelease Notes |
| https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gohugo hugo | >= 0.123.0, < 0.161.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |