# CVE-2026-100693: Hugo case-sensitive URL scheme validation bypass in security.http.urls

Source: https://junglewise.ai/threats/cve-2026-100693-hugo-versions-from-v0-162-0-before-v0-166-0-contain-a-case  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100693 · Severity: high · CVSS 8.4 · Published 2026-09-26

Hugo is a static site generator used to build websites. In versions 0.162.0 through 0.165.x, attackers can bypass security restrictions on outbound network requests by using mixed-case URL schemes (like "HTTP://" instead of "http://"). This allows an attacker to fetch content from restricted internal IP addresses like localhost, potentially accessing sensitive configuration data or internal services.

Technologies: [Gohugoio Hugo](https://junglewise.ai/threats/technologies/gohugoio-hugo). Vendors: [Gohugoio](https://junglewise.ai/threats/vendors/gohugoio).

## Quick answers

**Is CVE-2026-100693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100693 being exploited in the wild.

**How severe is CVE-2026-100693?** High severity, with a CVSS score of 8.4, published 26 September 2026.

**Which products and versions are affected?** Gohugoio Hugo >=0.162.0, <0.166.0.

**Is there a fix for CVE-2026-100693?** A patch was published on 2026-09-26: Version 0.166.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100693 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-100693?** Check whether you run Gohugoio Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a case-sensitivity flaw (CWE-178) in the default IP-literal deny rule of security.http.urls, which validates URLs in resources.GetRemote calls. The deny rule failed to normalize URL scheme casing before validation, so an uppercase or mixed-case scheme bypassed the filter. An attacker who can control URLs passed to resources.GetRemote can exploit this to reach restricted IP addresses without authentication.

## Affected products

- gohugoio Hugo >=0.162.0, <0.166.0

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Version 0.166.0 released with fix

## References

- [https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw](https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw)
- [https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass](https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass)

## Related threats

- [Hugo stored cross-site scripting in Table of Contents heading IDs](https://junglewise.ai/threats/cve-2026-109597-hugo-from-v0-60-0-before-v0-167-0-contains-a-stored-cross-site)
- [Hugo cross-site scripting via text/org content files](https://junglewise.ai/threats/cve-2026-100694-hugo-is-a-static-site-generator-in-versions-from-v0-56-0-through)
- [Hugo symlink confinement bypass in mount roots](https://junglewise.ai/threats/cve-2026-100692-hugo-is-a-static-site-generator-in-versions-after-v0-123-0-and)
- [Hugo arbitrary file read via symlinks in Node.js tools](https://junglewise.ai/threats/cve-2026-100690-hugo-versions-from-v0-161-0-through-v0-165-0-run-node-js-tools)