Bep

**Name of the Vulnerable Software and Affected Versions** Hugo versions 0.123.0 through 0.163.0 **Description** A regression in the virtual filesystem allows a symlink placed within a theme or local mount to read arbitrary files accessible to the user running the application. This occurs because the `RootMappingFs.statRoot` function calls `Stat`, which follows symbolic links, instead of `Lstat`. Consequently, a direct `os.ReadFile` call on a symlink pointing outside the mount tree returns the contents of the target file. **Recommendations** Update Hugo to version 0.163.1.