CVE-2026-10582

Name of the Vulnerable Software and Affected Versions Hugo versions 0.91.0 through 0.165.0

Description An issue exists in the security.http.urls allowlist which serves as the sole control for outbound fetches performed by resources.GetRemote. The CheckAllowedHTTPURL function in config/security/securityConfig.go validates the URL text and canonicalized IPv4 hosts but fails to resolve hostnames or inspect the actual destination address the HTTP client connects to. Additionally, the client in resources/resource factories/create/create.go lacks a dial-time hook, meaning no validation occurs during the connection phase. Consequently, a hostname resolving to a loopback, private, or cloud-metadata address can bypass the policy. An attacker capable of providing a URL through content, such as a CMS field or front-matter field, can force the build process to fetch data from an internal endpoint and include the response in the static output, leading to Server-Side Request Forgery (SSRF).

Recommendations Update Hugo to a version later than 0.165.0. As a temporary mitigation, restrict the ability for untrusted users to provide URLs via front-matter or CMS fields used by resources.GetRemote.