CVE-2026-109596

Received Received - Intake

Improper Link Resolution in Hugo Static Site Generator

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109596

Affected Vendors & Products

Vendor	Product	Version / Range
gohugoio	hugo	0.162.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

Hugo versions from v0.162.0 to before v0.167.0 have an improper link resolution flaw. Attackers with control over a theme can create a symlink or NTFS junction in a virtual ancestor directory. This tricks Hugo's resource matching into listing and publishing local files outside the intended directory during builds.

Impact Analysis

If you use a vulnerable Hugo version and install a malicious theme or module, attackers could access sensitive files on your system. This includes configuration files, source code, or other confidential data stored locally. The impact depends on what files are accessible and how they are used.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements. If exploited, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Hugo to version v0.167.0 or later to address the improper link resolution vulnerability. Avoid using untrusted themes or modules that may contain malicious symlinks or junctions.

Hi! I’m here to help you understand CVE-2026-109596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70