# CVE-2026-109574: Hugo path traversal in css.Sass import fallback

Source: https://junglewise.ai/threats/cve-2026-109574-hugo-before-v0-167-0-contains-a-path-traversal-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109574 · Severity: medium · CVSS 5.5 · Published 2026-10-12

Hugo is a static site generator used to build websites from templates and content. A vulnerability in its Sass CSS compiler allows malicious themes or plugins to read arbitrary files from the server where the site is built, including sensitive configuration files, private keys, or other secrets, which could then be embedded in the published website.

Technologies: [Hugo](https://junglewise.ai/threats/technologies/hugo). Vendors: [Hugo](https://junglewise.ai/threats/vendors/hugo).

## Quick answers

**Is CVE-2026-109574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109574 being exploited in the wild.

**How severe is CVE-2026-109574?** Medium severity, with a CVSS score of 5.5, published 12 October 2026.

**Which products and versions are affected?** Hugo before v0.167.0.

**Is there a fix for CVE-2026-109574?** Yes: fixed in v0.167.0. Until then: Do not use themes or modules from untrusted sources. Review @import and @use statements in Sass entry points for paths that reference locations outside the project directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109574 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-109574?** Check whether you run Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v0.167.0

Do not use themes or modules from untrusted sources. Review @import and @use statements in Sass entry points for paths that reference locations outside the project directory.

## Technical details

The css.Sass component resolves @import and @use directives not found in Hugo's virtual file system by passing them to the underlying Sass compiler (Dart Sass or LibSASS) with the real filesystem as include paths. The compiler does not respect Hugo's project root boundary and follows symlinks, allowing a malicious theme to traverse outside the project directory via relative paths like @import "../../../../secret" or absolute/symlinked imports. An attacker controlling a theme or module can read any file accessible to the build process and publish the contents as CSS.

## Affected products

- Hugo Hugo before v0.167.0

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched

## References

- [https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf](https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf)
- [https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback](https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback)

## Related threats

- [Hugo path traversal in js.Build and css.Build via ESBuild](https://junglewise.ai/threats/cve-2026-109595-hugo-from-v0-84-0-before-v0-167-0-contains-a-path-traversal)
- [Hugo stored cross-site scripting in lineAnchors](https://junglewise.ai/threats/cve-2026-100691-hugo-versions-0-75-0-through-0-165-x-contain-a-stored-cross-site)
- [Hugo insufficient permission restriction via TailwindCSS](https://junglewise.ai/threats/cve-2026-89259-hugo-insufficient-permission-restriction-via-tailwindcss)
- [Hugo fenced code block attribute injection](https://junglewise.ai/threats/cve-2026-10618-hugo-fenced-code-block-attribute-injection)
- [Hugo SSRF in resources.GetRemote via security.http.urls allowlist bypass](https://junglewise.ai/threats/cve-2026-10582-hugo-ssrf-in-resources-getremote-via-security-http-urls-allowlist)