Improper Link Resolution Vulnerability in Hugo from GoHugo
CVE-2026-109596

6.7MEDIUM

Key Information:

Vendor

Gohugoio

Status
Hugo
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109596?

Hugo versions from v0.162.0 up to, but not including, v0.167.0 are prone to an improper link resolution vulnerability. This flaw can allow malicious themes or modules to expose sensitive files beyond their designated root through the use of nested-mount ancestor directories. By leveraging a symlink or NTFS junction within a virtual ancestor directory, attackers can manipulate the build process to list and publish local files, potentially leading to unauthorized disclosure of confidential data.

Affected Version(s)

hugo 0.162.0 < 0.167.0

hugo 0.167.0

References

https://github.com/gohugoio/hugo/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/hugo-from-0.162.0-be...
third-party-advisory

CVSS V4

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

White0xdi3
.