Executive brief
Hugo is a static site generator used to build websites from templates and content files. In affected versions, a flaw allows symlinks placed in theme directories to bypass security boundaries, enabling an attacker to read files outside the intended project folder and expose them in the built website. This could leak sensitive configuration files, private keys, or other confidential data stored on the build server.
Technical details
The vulnerability is a symlink path traversal (CWE-59) affecting the resources.Get and os.ReadFile functions in Hugo. The root cause is incomplete symlink filtering introduced in earlier fixes—parent directory symlinks were not being dropped during direct resource lookups, only symlinks in the immediate resource path. An attacker must place or convince a site author to place a malicious symlink inside a mounted directory (e.g., in a locally-vendored theme under themes/). When Hugo processes resources via direct lookups, it follows the symlink and reads files outside the project boundary. Themes downloaded as Go modules from GitHub are not affected because symlinks are stripped during download; only locally vendored or committed themes are vulnerable. The issue is fixed in v0.165.0.
Affected products
- gohugoio Hugo after v0.123.0 before v0.165.0
Timeline
- 2026-08-27: disclosed
- 2026-09-11: advisory: CVE-2026-89258 published
- 2026-09-11: patched: Fix released in v0.165.0