Executive brief
Hugo is a static site generator that builds websites from templates and content. Versions after 0.123.0 and before 0.166.0 have a flaw where symlinks in themes or modules can point to files outside the intended directory, allowing attackers to read sensitive files and publish them to the public website. This breaks Hugo's security model that restricts themes and modules from accessing files outside their intended locations.
Technical details
Hugo's symlink confinement checks incorrectly stopped at the mount root, allowing symlinked mount roots in themes or vendored modules to bypass path restrictions. An attacker can place a symlink at a mount root (e.g., themes/mytheme/assets → /some/dir/outside) that is readable via resources.Get, resources.Match and publishable through static mounts. Go module–sourced modules are unaffected since Go module zips cannot contain symlinks.
Affected products
- gohugoio Hugo after v0.123.0 before v0.166.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in v0.166.0