Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-89258: Hugo before 0.165.0 can expose files via symlink
CVE-2026-89258 · published 1 month ago
Summary
Versions of the Hugo site generator released after 0.123.0 and before 0.165.0 may follow symbolic links placed in certain folders, allowing files outside the project to be read and included in the generated site. If an attacker or a careless author adds such a link, confidential files could be exposed. Upgrade Hugo to version 0.165.0 or later to stop this behavior.
What to do
- Update debian hugo to version 0.165.0-1.
- Update gohugoio hugo to version 0.165.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gohugoio | hugo | < 0.165.0 |
| Debian:12 | debian | hugo | All versions |
| Debian:14 | debian | hugo |
< 0.165.0-1 Fix: upgrade to 0.165.0-1
|
| Ubuntu:16.04:LTS | canonical | hugo | All versions |
Original advisory text
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypa...
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-vrv5-r5rf-6v4j
- https://www.vulncheck.com/advisories/hugo-before-0.165.0-symlink-confinement-byp...
- https://security-tracker.debian.org/tracker/CVE-2026-89258 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89258... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-89258 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-89258 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-89258 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-59Link Following
Timeline
Published11 Sep 2026
Updated11 Oct 2026
First seen11 Sep 2026
Sources
CVE-2026-89258 · NVD
CVE-2026-89258 · MITRE
DEBIAN-CVE-2026-89258 · OSV
CVE-2026-89258 · OSV
GHSA-vrv5-r5rf-6v4j · GHSA
UBUNTU-CVE-2026-89258 · OSV
Track software like this
Free during beta