CVE-2026-50135

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.161.1

Description A regression in the virtual filesystem allows a symlink confinement bypass. The RootMappingFs.statRoot function calls Stat, which follows symlinks, instead of Lstat. This allows a direct lookup via the resources.Get function to follow a symlink pointing outside the mount tree, enabling the reading of arbitrary files accessible to the user running the software. This issue occurs when an attacker can place a symlink inside a mounted directory, such as a locally-vendored theme under themes/.

Recommendations Update to version 0.162.0.