Is CVE-2026-50135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50135 being exploited in the wild.

How severe is CVE-2026-50135?

Medium severity, with a CVSS score of 4, published 6 July 2026.

Which products and versions are affected?

github.com/gohugoio/hugo (Go) >= 0.123.0, = 0.123.0, < 0.162.0.

Is there a fix for CVE-2026-50135?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50135 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-50135?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50135: Hugo symlink confinement bypass in resources.Get

Q: Is there a fix for CVE-2026-50135?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50135 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-50135?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50135 · Severity: medium · CVSS 4 · Published 2026-07-06

Hugo is a popular tool used to build websites from static files. A security flaw allowed malicious website themes or local files to bypass security boundaries by using symbolic links (shortcuts) to read sensitive files on the computer running the software. This could allow an attacker to steal private data or configuration files if they can convince a site administrator to use a compromised theme or file.

Technologies: github.com/gohugoio/hugo (Go), Hugo. Vendors: Go, Hugo.

Quick answers

Is CVE-2026-50135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50135 being exploited in the wild.
How severe is CVE-2026-50135?: Medium severity, with a CVSS score of 4, published 6 July 2026.
Which products and versions are affected?: github.com/gohugoio/hugo (Go) >= 0.123.0, < 0.162.0, SEMVER:introduced=0.123.0,fixed=0.162.0; Hugo >= 0.123.0, < 0.162.0.
Is there a fix for CVE-2026-50135?: Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50135 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-50135?: Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later
```
go get github.com/gohugoio/hugo@v0.162.0
```

Technical details

A regression in Hugo's virtual filesystem (specifically RootMappingFs.statRoot) caused it to use Stat instead of Lstat, leading to improper link resolution (CWE-59). This allowed direct calls to resources.Get to follow symbolic links pointing outside of the defined mount tree. An attacker who can place a malicious symlink in a local mount, such as a vendored theme directory, can read any file accessible to the Hugo process. This vulnerability does not affect Go-module themes downloaded from GitHub as symlinks are stripped during that process. The issue is fixed in version 0.162.0 by ensuring Lstat is used to reject symlinked entries.

Affected products

gohugoio Hugo >= 0.123.0, < 0.162.0

Identifiers

CVE-2026-50135
GHSA-fw87-fv5r-9fpw
GO-2026-5380

Timeline

2026-05-26: patched: Version 0.162.0 released
2026-05-28: advisory: GitHub Security Advisory GHSA-fw87-fv5r-9fpw published
2026-07-06: disclosed: CVE-2026-50135 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.