CVE-2026-89258

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.1 through 0.164.x

Description Path confinement can be bypassed because symlinks in parent directories are not dropped during direct resource lookups. An attacker who places a symlink inside a mounted directory, such as a locally vendored theme under themes/, can cause functions that perform direct lookups, including resources.Get() and os.ReadFile(), to follow the symlink. This allows the reading of files outside the intended project boundaries, leading to the disclosure of their contents in the built site. Themes mounted as Go modules from GitHub and multi-directory walks are not affected.

Recommendations Update to version 0.165.0.