CVE-2026-109596

MEDIUM 5.5

Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

CWE	CWE-59
Vendor	gohugoio
Product	hugo
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for gohugoio hugo

Be the first to know when new medium vulnerabilities affecting gohugoio hugo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

gohugoio / hugo

0.162.0 < 0.167.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47 vulncheck.com: https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor

Credits

White0xdi3