CVE-2026-100690
Received Received - Intake

Symbolic Link Escape in Hugo Static Site Generator

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100690
EUVD
EUVD-2026-87663

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hugo hugo From 0.161.0 (inc) to 0.165.0 (inc)
hugo hugo 0.166.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hugo versions 0.161.0 to 0.165.0 are vulnerable to arbitrary file reads via symlinks. The Node.js tools used in Hugo (PostCSS, TailwindCSS, Babel) operate under a permission model that only checks lexical paths, allowing symlinks to escape the project directory sandbox. An attacker can create a malicious symlink (e.g., assets/css/x.css pointing to /etc/passwd) and use a PostCSS plugin to read arbitrary files, potentially embedding sensitive data in the published site.

Impact Analysis

This vulnerability allows an attacker to read any file accessible to the Hugo build process, potentially exposing sensitive data like system files or configuration details. The attacker needs the ability to contribute content to a Hugo project, such as via a pull request. The impact includes unauthorized data disclosure and potential embedding of sensitive information in the published site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of personal or health data through arbitrary file reads may result in legal penalties, reputational damage, and loss of trust.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart