Path Traversal Vulnerability in Hugo Static Site Generator
CVE-2026-100692

8.7HIGH

Key Information:

Vendor

Gohugoio

Status
Hugo
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100692?

A path traversal vulnerability exists in the Hugo static site generator versions between v0.123.0 and v0.165.9, where symlink checks do not effectively confine operations to the intended directories. This allows potential access to filesystem paths beyond the intended scope, enabling themes or modules placed in the themes/ directory to contain symlinks that point to external locations. Consequently, files accessed through these symlinks can be read during site builds, compromising the integrity of the build process. Users are advised to upgrade to version v0.166.0 or later, which implements proper confinement of symlinked directories and protects against unauthorized access to system files.

Affected Version(s)

hugo 0 < 0.166.0

hugo 0.166.0

References

https://github.com/gohugoio/hugo/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/hugo-before-0.166.0-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DONG2209
.