Is CVE-2026-89258 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89258 being exploited in the wild.

How severe is CVE-2026-89258?

Medium severity, with a CVSS score of 6.3, published 11 September 2026.

Which products and versions are affected?

gohugoio Hugo after v0.123.0 before v0.165.0.

Is there a fix for CVE-2026-89258?

A patch was published on 2026-09-11: Fix released in v0.165.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89258 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-89258?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89258: Hugo symlink confinement bypass in resources.Get and os.ReadFile

CVE-2026-89258 · Severity: medium · CVSS 6.3 · Published 2026-09-11

Hugo is a static site generator used to build websites from templates and content files. In affected versions, a flaw allows symlinks placed in theme directories to bypass security boundaries, enabling an attacker to read files outside the intended project folder and expose them in the built website. This could leak sensitive configuration files, private keys, or other confidential data stored on the build server.

Quick answers

Is CVE-2026-89258 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89258 being exploited in the wild.
How severe is CVE-2026-89258?: Medium severity, with a CVSS score of 6.3, published 11 September 2026.
Which products and versions are affected?: gohugoio Hugo after v0.123.0 before v0.165.0.
Is there a fix for CVE-2026-89258?: A patch was published on 2026-09-11: Fix released in v0.165.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89258 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-89258?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a symlink path traversal (CWE-59) affecting the resources.Get and os.ReadFile functions in Hugo. The root cause is incomplete symlink filtering introduced in earlier fixes—parent directory symlinks were not being dropped during direct resource lookups, only symlinks in the immediate resource path. An attacker must place or convince a site author to place a malicious symlink inside a mounted directory (e.g., in a locally-vendored theme under themes/). When Hugo processes resources via direct lookups, it follows the symlink and reads files outside the project boundary. Themes downloaded as Go modules from GitHub are not affected because symlinks are stripped during download; only locally vendored or committed themes are vulnerable. The issue is fixed in v0.165.0.

Affected products

gohugoio Hugo after v0.123.0 before v0.165.0

Timeline

2026-08-27: disclosed
2026-09-11: advisory: CVE-2026-89258 published
2026-09-11: patched: Fix released in v0.165.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.