CVE-2026-89258
Received Received - Intake

Path Traversal in Hugo Static Site Generator

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89258
EUVD
EUVD-2026-76070

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Hugo versions after v0.123.0 and before v0.165.0. It allows symlinks in parent directories to bypass path restrictions. Attackers can place or trick site authors into placing a symlink in a mounted directory, such as a locally vendored theme. Functions like resources.Get and os.ReadFile follow the symlink, accessing files outside the intended project boundaries and disclosing their contents in the built site.

Detection Guidance

To detect this vulnerability, inspect your Hugo project directories for unexpected symlinks in parent directories, especially within themes/ or other mounted directories. Check for symlinks pointing outside the project root that could be followed by resources.Get or os.ReadFile. Review build logs for files accessed outside expected paths.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive files outside the Hugo project directory. Attackers could read confidential data, such as configuration files or source code, and include it in the generated static site. This could lead to data leaks or exposure of internal information.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Hugo versions may face legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Upgrade Hugo to version 0.165.0 or later immediately. Remove any untrusted symlinks in project directories, particularly in themes/. Avoid using locally vendored themes from untrusted sources. Monitor builds for unexpected file access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart