# CVE-2026-50135: Hugo symlink confinement bypass in resources.Get

Source: https://junglewise.ai/threats/cve-2026-50135-hugo-symlink-confinement-bypass-in-resources-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-50135 · Severity: medium · CVSS 4 · Published 2026-07-06

Hugo is a popular tool used to build websites from static files. A security flaw allowed malicious website themes or local files to bypass security boundaries by using symbolic links (shortcuts) to read sensitive files on the computer running the software. This could allow an attacker to steal private data or configuration files if they can convince a site administrator to use a compromised theme or file.

Technologies: [github.com/gohugoio/hugo (Go)](https://junglewise.ai/threats/technologies/github-com-gohugoio-hugo), [Hugo](https://junglewise.ai/threats/technologies/hugo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hugo](https://junglewise.ai/threats/vendors/hugo).

## Quick answers

**Is CVE-2026-50135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50135 being exploited in the wild.

**How severe is CVE-2026-50135?** Medium severity, with a CVSS score of 4, published 6 July 2026.

**Which products and versions are affected?** github.com/gohugoio/hugo (Go) >= 0.123.0, < 0.162.0, SEMVER:introduced=0.123.0,fixed=0.162.0; Hugo >= 0.123.0, < 0.162.0.

**Is there a fix for CVE-2026-50135?** Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50135 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-50135?** Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later

  ```sh
  go get github.com/gohugoio/hugo@v0.162.0
  ```


## Technical details

A regression in Hugo's virtual filesystem (specifically RootMappingFs.statRoot) caused it to use Stat instead of Lstat, leading to improper link resolution (CWE-59). This allowed direct calls to resources.Get to follow symbolic links pointing outside of the defined mount tree. An attacker who can place a malicious symlink in a local mount, such as a vendored theme directory, can read any file accessible to the Hugo process. This vulnerability does not affect Go-module themes downloaded from GitHub as symlinks are stripped during that process. The issue is fixed in version 0.162.0 by ensuring Lstat is used to reject symlinked entries.

## Affected products

- gohugoio Hugo >= 0.123.0, < 0.162.0

## Identifiers

- CVE-2026-50135
- GHSA-fw87-fv5r-9fpw
- GO-2026-5380

## Timeline

- 2026-05-26: patched: Version 0.162.0 released
- 2026-05-28: advisory: GitHub Security Advisory GHSA-fw87-fv5r-9fpw published
- 2026-07-06: disclosed: CVE-2026-50135 published to NVD

## References

- [https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a](https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a)
- [https://github.com/gohugoio/hugo/releases/tag/v0.162.0](https://github.com/gohugoio/hugo/releases/tag/v0.162.0)
- [https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw](https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw)

## Related threats

- [Hugo path traversal in js.Build and css.Build via ESBuild](https://junglewise.ai/threats/cve-2026-109595-hugo-from-v0-84-0-before-v0-167-0-contains-a-path-traversal)
- [Hugo path traversal in css.Sass import fallback](https://junglewise.ai/threats/cve-2026-109574-hugo-before-v0-167-0-contains-a-path-traversal-vulnerability-in)
- [Hugo stored cross-site scripting in lineAnchors](https://junglewise.ai/threats/cve-2026-100691-hugo-versions-0-75-0-through-0-165-x-contain-a-stored-cross-site)
- [Hugo insufficient permission restriction via TailwindCSS](https://junglewise.ai/threats/cve-2026-89259-hugo-insufficient-permission-restriction-via-tailwindcss)
- [Hugo fenced code block attribute injection](https://junglewise.ai/threats/cve-2026-10618-hugo-fenced-code-block-attribute-injection)