CVE-2026-100690

Analyzed Analyzed - Analysis Complete

Symbolic Link Escape in Hugo Static Site Generator

Publication date: 2026-09-26

Last updated on: 2026-09-30

Assigner: VulnCheck

Description

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100690

EUVD

EUVD-2026-87663

Affected Vendors & Products

Vendor	Product	Version / Range
gohugo	hugo	From 0.161.0 (inc) to 0.166.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

Hugo versions 0.161.0 to 0.165.0 are vulnerable to arbitrary file reads via symlinks. The Node.js tools used in Hugo (PostCSS, TailwindCSS, Babel) operate under a permission model that only checks lexical paths, allowing symlinks to escape the project directory sandbox. An attacker can create a malicious symlink (e.g., assets/css/x.css pointing to /etc/passwd) and use a PostCSS plugin to read arbitrary files, potentially embedding sensitive data in the published site.

Detection Guidance

Check Hugo version with 'hugo version'. If between v0.161.0 and v0.165.0, inspect project directories for suspicious symlinks using 'find . -type l -ls' or 'ls -laR | grep -E '->''. Review build logs for Node.js tool usage (PostCSS, TailwindCSS, Babel).

Scan for unexpected file reads during builds by monitoring file access with tools like strace or auditd. Compare build outputs against expected content to detect embedded sensitive data.

Impact Analysis

This vulnerability allows an attacker to read any file accessible to the Hugo build process, potentially exposing sensitive data like system files or configuration details. The attacker needs the ability to contribute content to a Hugo project, such as via a pull request. The impact includes unauthorized data disclosure and potential embedding of sensitive information in the published site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of personal or health data through arbitrary file reads may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Hugo to v0.166.0 or later immediately. If unable to upgrade, disable Node.js tools in Hugo configuration or restrict Node.js execution permissions. Avoid using untrusted content in Hugo projects.

Review and remove any suspicious symlinks in project directories. Implement strict input validation for project contributions to prevent malicious symlinks.

Hi! I’m here to help you understand CVE-2026-100690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70