Executive brief
Hugo, a popular tool for building websites, contains a security flaw in how it fetches data from external servers. While Hugo allows administrators to restrict which websites it can connect to, an attacker could bypass these restrictions by using a web redirect. This could allow the tool to access internal systems or restricted data that should have been blocked by the security policy.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo's 'resources.GetRemote' function due to improper validation of HTTP redirects. While the initial URL is checked against the 'security.http.urls' allow-list, subsequent 3xx redirect hops were not re-validated in versions prior to 0.162.0. An attacker who controls a permitted host, or can influence its DNS/responses, can redirect Hugo to fetch resources from forbidden targets, including localhost or internal IP addresses. This bypasses host-shape restrictions and security policies intended to constrain network access during builds. The fix, introduced in version 0.162.0, implements a 'CheckRedirect' handler that validates every hop in the redirect chain against the allow-list and limits the chain to 10 hops.
Affected products
- gohugoio Hugo >= 0.91.0, < 0.162.0
Timeline
- 2026-05-26: patched: Version 0.162.0 released
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE-2026-50134 published to NVD