Executive brief
Hugo is a static site generator used to build websites. In versions 0.162.0 through 0.165.x, attackers can bypass security restrictions on outbound network requests by using mixed-case URL schemes (like "HTTP://" instead of "http://"). This allows an attacker to fetch content from restricted internal IP addresses like localhost, potentially accessing sensitive configuration data or internal services.
Technical details
The vulnerability is a case-sensitivity flaw (CWE-178) in the default IP-literal deny rule of security.http.urls, which validates URLs in resources.GetRemote calls. The deny rule failed to normalize URL scheme casing before validation, so an uppercase or mixed-case scheme bypassed the filter. An attacker who can control URLs passed to resources.GetRemote can exploit this to reach restricted IP addresses without authentication.
Affected products
- gohugoio Hugo >=0.162.0, <0.166.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Version 0.166.0 released with fix