CVE-2026-89258 Details
Description
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
A vulnerability in Hugo, a static site generator, exists in versions after 0.123.0 and prior to 0.165.0. The issue arises because symlinks in parent directories were not removed during direct resource lookups, enabling a bypass of path confinement. An attacker could place a symlink in a mounted directory, such as a locally vendored theme, which would then be followed by functions like resources.Get and os.ReadFile. This could result in unauthorized access to files outside the project's intended boundaries, with the contents being disclosed in the built site. Notably, themes sourced as Go modules from GitHub are not affected, as their symlinks are removed upon download. The vulnerability is an incomplete fix related to previous advisories GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw, and has been addressed in Hugo version 0.165.0.
Users can upgrade to Hugo version 0.165.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hugo | >= 0.123.0, < 0.165.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |