CVE-2026-58403
Description
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
How to fix
- gohugo hugo0.163.1 or later
- github.com/gohugoio/hugo0.163.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gohugo hugo | 0.123.0 ≤ v < 0.163.1 | 0.163.1 |
| github.com/gohugoio/hugoGo | 0.123.0 ≤ v < 0.163.1 | 0.163.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.