CVE-2026-50135

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a	Patch
https://github.com/gohugoio/hugo/releases/tag/v0.162.0	Product Release Notes
https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hugo es un generador de sitios estáticos. Desde la versión 0.123.0 hasta la 0.161.1, una regresión hizo que RootMappingFs.statRoot usara Stat (sigue enlaces simbólicos) en lugar de Lstat, por lo que un resources.Get directo de un enlace simbólico que apuntaba fuera de su punto de montaje devolvía el contenido del destino - permitiendo que un enlace simbólico plantado en un punto de montaje local (por ejemplo, un tema ’themes/’ suministrado) leyera archivos arbitrarios accesibles para el usuario de Hugo. Los temas de módulos Go de GitHub (con los enlaces simbólicos eliminados) y los recorridos de directorios no se vieron afectados. Corregido en la versión 0.162.0.

Information

Published : 2026-07-06 21:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-50135

Mitre link : CVE-2026-50135

CVE.ORG link : CVE-2026-50135

JSON object : View

Products Affected

gohugo

hugo

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-50135", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50135", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T16:52:31.351209Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": ">= 0.123.0, < 0.162.0"}]}]}], "published": "2026-07-06T21:16:56.347", "references": [{"url": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made \u00a0RootMappingFs.statRoot\u00a0 use \u00a0Stat\u00a0 (follows symlinks) instead of \u00a0Lstat\u00a0, so a direct \u00a0resources.Get\u00a0 of a symlink pointing outside its mount returned the target's contents \u2014 letting a symlink planted in a local mount (e.g. a vendored \u00a0themes/\u00a0 theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0."}, {"lang": "es", "value": "Hugo es un generador de sitios est\u00e1ticos. Desde la versi\u00f3n 0.123.0 hasta la 0.161.1, una regresi\u00f3n hizo que RootMappingFs.statRoot usara Stat (sigue enlaces simb\u00f3licos) en lugar de Lstat, por lo que un resources.Get directo de un enlace simb\u00f3lico que apuntaba fuera de su punto de montaje devolv\u00eda el contenido del destino - permitiendo que un enlace simb\u00f3lico plantado en un punto de montaje local (por ejemplo, un tema \u2019themes/\u2019 suministrado) leyera archivos arbitrarios accesibles para el usuario de Hugo. Los temas de m\u00f3dulos Go de GitHub (con los enlaces simb\u00f3licos eliminados) y los recorridos de directorios no se vieron afectados. Corregido en la versi\u00f3n 0.162.0."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C293B2BB-CA8A-4ECD-9674-943C0196A0A1", "versionEndExcluding": "0.161.1", "versionStartIncluding": "0.123.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}