CVE-2026-89258
Hugo, a popular static site generator, had a flaw that let attackers read files outside the project by using symlinks in parent directories. The issue existed in versions after 0.123.0 but before 0.165.0. It was fixed in Hugo 0.165.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Hugo static site generator, versions 0.123.1 through 0.164.9, used by site authors and developers building static sites.
Real-world impact
An attacker who can place a symlink inside a mounted directory (e.g., a theme folder) can trick Hugo’s file‑lookup functions into reading arbitrary files on the host, exposing sensitive data in the built site.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact on confidentiality, integrity, and availability: it allows an attacker to read any file on the system, bypassing normal project boundaries, with no authentication or user interaction required.
What to do about it
- 01Upgrade Hugo to version 0.165.0 or later.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 11, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.