Executive brief
Hugo is a popular tool used to build websites from static files. A security flaw allowed malicious website themes or local files to bypass security boundaries by using symbolic links (shortcuts) to read sensitive files on the computer running the software. This could allow an attacker to steal private data or configuration files if they can convince a site administrator to use a compromised theme or file.
Technical details
A regression in Hugo's virtual filesystem (specifically RootMappingFs.statRoot) caused it to use Stat instead of Lstat, leading to improper link resolution (CWE-59). This allowed direct calls to resources.Get to follow symbolic links pointing outside of the defined mount tree. An attacker who can place a malicious symlink in a local mount, such as a vendored theme directory, can read any file accessible to the Hugo process. This vulnerability does not affect Go-module themes downloaded from GitHub as symlinks are stripped during that process. The issue is fixed in version 0.162.0 by ensuring Lstat is used to reject symlinked entries.
Affected products
- gohugoio Hugo >= 0.123.0, < 0.162.0
Timeline
- 2026-05-26: patched: Version 0.162.0 released
- 2026-05-28: advisory: GitHub Security Advisory GHSA-fw87-fv5r-9fpw published
- 2026-07-06: disclosed: CVE-2026-50135 published to NVD