Is CVE-2026-100692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100692 being exploited in the wild.

How severe is CVE-2026-100692?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Gohugoio Hugo after v0.123.0 before v0.166.0.

Is there a fix for CVE-2026-100692?

A patch was published on 2026-09-26: Fixed in v0.166.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100692 attacked?

It is attacked with local access or from the adjacent network.

Am I affected by CVE-2026-100692?

Check whether you run Gohugoio Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100692: Hugo symlink confinement bypass in mount roots

CVE-2026-100692 · Severity: high · CVSS 7.5 · Published 2026-09-26

Hugo is a static site generator that builds websites from templates and content. Versions after 0.123.0 and before 0.166.0 have a flaw where symlinks in themes or modules can point to files outside the intended directory, allowing attackers to read sensitive files and publish them to the public website. This breaks Hugo's security model that restricts themes and modules from accessing files outside their intended locations.

Technologies: Gohugoio Hugo. Vendors: Gohugoio.

Quick answers

Is CVE-2026-100692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100692 being exploited in the wild.
How severe is CVE-2026-100692?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Gohugoio Hugo after v0.123.0 before v0.166.0.
Is there a fix for CVE-2026-100692?: A patch was published on 2026-09-26: Fixed in v0.166.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100692 attacked?: It is attacked with local access or from the adjacent network.
Am I affected by CVE-2026-100692?: Check whether you run Gohugoio Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Hugo's symlink confinement checks incorrectly stopped at the mount root, allowing symlinked mount roots in themes or vendored modules to bypass path restrictions. An attacker can place a symlink at a mount root (e.g., themes/mytheme/assets → /some/dir/outside) that is readable via resources.Get, resources.Match and publishable through static mounts. Go module–sourced modules are unaffected since Go module zips cannot contain symlinks.

Affected products

gohugoio Hugo after v0.123.0 before v0.166.0

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in v0.166.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.