Path Traversal Vulnerability in Hugo by GoHugoIO

CVE-2026-109574

What is CVE-2026-109574?

Hugo, prior to version 0.167.0, is susceptible to a path traversal vulnerability through its css.Sass component. This flaw enables malicious users to craft themes or modules that can access files beyond the designated project root. By leveraging the Sass compiler's import fallback mechanism, attackers can use relative, absolute, or symlinked @import or @use directives to inject stylesheets that incorporate sensitive files, which may compromise the integrity of the published site CSS. Users are encouraged to upgrade to the latest version to mitigate this risk.

References