CVE-2026-58403

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.163.0

Description A regression in the virtual filesystem allows a symlink placed within a theme or local mount to read arbitrary files accessible to the user running the application. This occurs because the RootMappingFs.statRoot function calls Stat, which follows symbolic links, instead of Lstat. Consequently, a direct os.ReadFile call on a symlink pointing outside the mount tree returns the contents of the target file.

Recommendations Update Hugo to version 0.163.1.