# CVE-2026-44301: Hugo path traversal in Node-based asset pipelines

Source: https://junglewise.ai/threats/cve-2026-44301-hugo-path-traversal-in-node-based-asset-pipelines  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44301 · Severity: high · CVSS 8.1 · Published 2026-05-12

Hugo is a popular tool used to build websites from source files. A security flaw was found where building a website from an untrusted source could allow malicious code to read or write files anywhere on the developer's computer. This could lead to the theft of sensitive data or the modification of system files if a user attempts to build a compromised project.

Technologies: [github.com/gohugoio/hugo (Go)](https://junglewise.ai/threats/technologies/github-com-gohugoio-hugo), [Hugo](https://junglewise.ai/threats/technologies/hugo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hugo](https://junglewise.ai/threats/vendors/hugo).

## Quick answers

**Is CVE-2026-44301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44301 being exploited in the wild.

**How severe is CVE-2026-44301?** High severity, with a CVSS score of 8.1, published 12 May 2026.

**Which products and versions are affected?** github.com/gohugoio/hugo (Go) >= 0.43.0, < 0.161.0, SEMVER:introduced=0,fixed=0.161.0, SEMVER:introduced=0.43.0,fixed=0.161.0; Hugo >= 0.43, < 0.161.0, >= 0.43.0, < 0.161.0, 0.43 to 0.161.0.

**Is there a fix for CVE-2026-44301?** Yes. github.com/gohugoio/hugo (Go): upgrade to 0.161.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44301 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44301?** Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gohugoio/hugo (Go): upgrade to 0.161.0 or later

  ```sh
  go get github.com/gohugoio/hugo@v0.161.0
  ```


## Technical details

Hugo versions 0.43 through 0.160.x contain a path traversal vulnerability (CWE-22) when processing Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS. The root cause is that Hugo invoked these external Node.js tools without enforcing file system restrictions or utilizing Node's permission model. An attacker can exploit this by providing a malicious Hugo site configuration or source files that, when built, execute code via these tools to read or write files outside the project's working directory. This requires the victim to run the 'hugo' command on an untrusted project. The vulnerability is fixed in version 0.161.0, which implements Node's permission model to restrict access to the site source directories.

## Affected products

- gohugoio Hugo 0.43 to 0.161.0

## Identifiers

- CVE-2026-44301
- GHSA-x597-9fr4-5857
- GO-2026-5740

## Timeline

- 2026-04-28: advisory: Vendor advisory published on GitHub
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857](https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857)

## Related threats

- [Hugo path traversal in js.Build and css.Build via ESBuild](https://junglewise.ai/threats/cve-2026-109595-hugo-from-v0-84-0-before-v0-167-0-contains-a-path-traversal)
- [Hugo path traversal in css.Sass import fallback](https://junglewise.ai/threats/cve-2026-109574-hugo-before-v0-167-0-contains-a-path-traversal-vulnerability-in)
- [Hugo stored cross-site scripting in lineAnchors](https://junglewise.ai/threats/cve-2026-100691-hugo-versions-0-75-0-through-0-165-x-contain-a-stored-cross-site)
- [Hugo insufficient permission restriction via TailwindCSS](https://junglewise.ai/threats/cve-2026-89259-hugo-insufficient-permission-restriction-via-tailwindcss)
- [Hugo fenced code block attribute injection](https://junglewise.ai/threats/cve-2026-10618-hugo-fenced-code-block-attribute-injection)