CVE-2026-109595

Received Received - Intake

Hugo Path Traversal via ESBuild Fallback Resolver

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109595

Affected Vendors & Products

Vendor	Product	Version / Range
gohugoio	hugo	0.84.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Hugo versions from 0.84.0 to before 0.167.0 have a path traversal flaw in ESBuild's fallback resolver. Malicious themes or modules can use relative imports or symlinks to read files outside the project root during JavaScript or CSS builds.

Detection Guidance

To detect this vulnerability, inspect Hugo projects for suspicious relative imports or symlinks in themes/modules. Check build logs for js.Build, js.Batch, or css.Build operations that reference files outside the project root. Review generated JavaScript/CSS output for unexpected file contents.

Impact Analysis

Attackers could bundle sensitive files into published output by exploiting this flaw. This may expose internal files, configuration data, or other confidential information to unintended users.

Mitigation Strategies

Upgrade Hugo to v0.167.0 or later. Avoid using untrusted themes/modules. Validate all file paths in build configurations. Restrict build user permissions to limit file access. Monitor build outputs for unauthorized file inclusions.

Hi! I’m here to help you understand CVE-2026-109595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70