CVE-2026-44301: Hugo path traversal in Node-based asset pipelines

CVE-2026-44301 · Severity: high · CVSS 8.1 · Published 2026-05-12

Hugo is a popular tool used to build websites from source files. A security flaw was found where building a website from an untrusted source could allow malicious code to read or write files anywhere on the developer's computer. This could lead to the theft of sensitive data or the modification of system files if a user attempts to build a compromised project.

Technologies: github.com/gohugoio/hugo (Go), Hugo. Vendors: Go, Hugo.

Quick answers

Is CVE-2026-44301 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44301 being exploited in the wild.
How severe is CVE-2026-44301?
High severity, with a CVSS score of 8.1, published 12 May 2026.
Which products and versions are affected?
github.com/gohugoio/hugo (Go) >= 0.43.0, < 0.161.0, SEMVER:introduced=0,fixed=0.161.0, SEMVER:introduced=0.43.0,fixed=0.161.0; Hugo >= 0.43, < 0.161.0, >= 0.43.0, < 0.161.0, 0.43 to 0.161.0.
Is there a fix for CVE-2026-44301?
Yes. github.com/gohugoio/hugo (Go): upgrade to 0.161.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44301 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44301?
Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gohugoio/hugo (Go): upgrade to 0.161.0 or later
    go get github.com/gohugoio/hugo@v0.161.0

Technical details

Hugo versions 0.43 through 0.160.x contain a path traversal vulnerability (CWE-22) when processing Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS. The root cause is that Hugo invoked these external Node.js tools without enforcing file system restrictions or utilizing Node's permission model. An attacker can exploit this by providing a malicious Hugo site configuration or source files that, when built, execute code via these tools to read or write files outside the project's working directory. This requires the victim to run the 'hugo' command on an untrusted project. The vulnerability is fixed in version 0.161.0, which implements Node's permission model to restrict access to the site source directories.

Affected products

  • gohugoio Hugo 0.43 to 0.161.0

Identifiers

  • CVE-2026-44301
  • GHSA-x597-9fr4-5857
  • GO-2026-5740

Timeline

  • 2026-04-28: advisory: Vendor advisory published on GitHub
  • 2026-05-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.