Arbitrary File Read Vulnerability in Hugo by GoHugoIO

CVE-2026-100690

What is CVE-2026-100690?

Hugo versions from v0.161.0 through v0.165.0 are susceptible to an arbitrary file read vulnerability due to improper handling of symbolic links. The Node.js permission model employed by these versions only restricts file system access based on lexical paths but fails to adequately prevent symlinks from circumventing this model. As a result, an attacker with the ability to contribute content, such as through a pull request, can create symlinks that reference sensitive files outside of the project's directory. This flaw can lead to the disclosure of sensitive information during the build process, particularly if certain Node.js tools like PostCSS are employed. A fix is available in version 0.166.0, which implements enhanced checks to prevent symlinks from resolving outside the specified security paths.

References