← Back to the live CVE advisory feed

CVE-2026-89258: hugo

Severity

9.3 (CRITICAL)

Vendor

GOHUGOIO

Affected versions

0 through before 0.165.0

Fixed version

0.165.0

Patch status

Patched

Published

2026-09-11T12:16:56.310

Modified

2026-09-11T15:21:12.850

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

View the official NVD record for CVE-2026-89258

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.