CVE-2026-109574

Received Received - Intake

Path Traversal in Hugo via Sass Import Fallback

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109574

Affected Vendors & Products

Vendor	Product	Version / Range
gohugoio	hugo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Hugo before v0.167.0 has a path traversal flaw in its Sass compiler (css.Sass). Malicious themes or modules can use relative, absolute, or symlinked @import or @use statements to read files outside the project directory during compilation. These files are then included in the published site CSS.

Detection Guidance

Check Hugo versions before v0.167.0 using 'hugo version'. Inspect theme or module stylesheets for @import or @use paths with relative, absolute, or symlinked targets that could traverse outside the project root.

Impact Analysis

If you use Hugo with vulnerable versions, attackers could craft themes or modules that expose sensitive files (e.g., configuration files, secrets) in your compiled CSS output. This could lead to information disclosure or further exploitation if those files contain credentials or API keys.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing personal or health data through unintended file inclusion in public CSS. Unauthorized data exposure may lead to compliance breaches, fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade Hugo to v0.167.0 or later. Review and remove untrusted themes or modules. Validate all @import and @use paths in stylesheets to ensure they do not reference external or sensitive files.

Hi! I’m here to help you understand CVE-2026-109574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70