File System Access Vulnerability in Hugo Static Site Generator
CVE-2026-44301

6.2MEDIUM

Key Information:

Vendor

Gohugoio

Status
Hugo
Vendor
CVE Published:
12 May 2026

What is CVE-2026-44301?

The static site generator Hugo, from version 0.43 up to but not including 0.161.0, allows for file system access vulnerabilities when Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS are used. When building a site using these tools, Hugo lacks restrictions on file system access, which may allow untrusted code to read or write files outside the intended project directory. Users building with trusted sites or without these Node tools remain unaffected. The issue was resolved in Hugo version 0.161.0.

Affected Version(s)

hugo >= 0.43.0, < 0.161.0

References

https://github.com/gohugoio/hugo/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.