Symlink Confinement Bypass in Hugo Static Site Generator
CVE-2026-89258

9.3CRITICAL

Key Information:

Vendor

Gohugoio

Status
Hugo
Vendor
CVE Published:
11 September 2026

What is CVE-2026-89258?

Hugo, a popular static site generator, is impacted by a vulnerability that allows symlinks in parent directories to bypass path confinement during direct resource lookups. This issue arises when an attacker manages to introduce a symlink in a mounted directory, such as within a theme, enabling functions like resources.Get and os.ReadFile to access and reveal files located outside the designated project boundaries. Although themes managed as Go modules from GitHub do not suffer from this issue due to symlink stripping upon download, the risk remains significant for other setups. This vulnerability follows earlier incomplete fixes and has been resolved in version 0.165.0.

Affected Version(s)

hugo 0 < 0.165.0

hugo 0.165.0

References

https://github.com/gohugoio/hugo/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/hugo-before-0.165.0-...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099
.