Path Traversal Vulnerability in Hugo by GoHugoIO

CVE-2026-109595

What is CVE-2026-109595?

Hugo versions from v0.84.0 to v0.167.0 contain a vulnerability allowing attackers to exploit the ESBuild's fallback resolver. The flaw enables the inclusion of malicious themes or modules, which can access files beyond the project root. By leveraging relative imports or symlinks that point to directories outside the intended path, attackers can bundle unauthorized files into the generated JavaScript or CSS output, posing a significant risk to applications and users relying on this framework.

References