CVE-2026-58403

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229	Patch
https://github.com/gohugoio/hugo/pull/15020	Issue Tracking
https://github.com/gohugoio/hugo/releases/tag/v0.163.1	Release Notes
https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hugo es un generador de sitios estáticos. Desde la v0.123.0 hasta la v0.163.0, el sistema de archivos virtual de Hugo está diseñado para que los archivos bajo un montaje no puedan acceder fuera del árbol de montaje, pero una regresión hizo que RootMappingFs.statRoot llamara a Stat, que sigue los enlaces simbólicos, en lugar de Lstat, de modo que una llamada directa a os.ReadFile ’somefile’ donde somefile era un enlace simbólico que apuntaba fuera del montaje devolvería el contenido del objetivo. Esto permitió efectivamente que un enlace simbólico plantado dentro de un tema o montaje local leyera archivos arbitrarios accesibles para el usuario que ejecuta hugo. Este problema está corregido en la v0.163.1.

Information

Published : 2026-07-06 20:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-58403

Mitre link : CVE-2026-58403

CVE.ORG link : CVE-2026-58403

JSON object : View

Products Affected

gohugo

hugo

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-58403", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58403", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T20:51:16.911843Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": ">= 0.123.0, < 0.163.1"}]}]}], "published": "2026-07-06T20:16:38.173", "references": [{"url": "https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/pull/15020", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile \"somefile\" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1."}, {"lang": "es", "value": "Hugo es un generador de sitios est\u00e1ticos. Desde la v0.123.0 hasta la v0.163.0, el sistema de archivos virtual de Hugo est\u00e1 dise\u00f1ado para que los archivos bajo un montaje no puedan acceder fuera del \u00e1rbol de montaje, pero una regresi\u00f3n hizo que RootMappingFs.statRoot llamara a Stat, que sigue los enlaces simb\u00f3licos, en lugar de Lstat, de modo que una llamada directa a os.ReadFile \u2019somefile\u2019 donde somefile era un enlace simb\u00f3lico que apuntaba fuera del montaje devolver\u00eda el contenido del objetivo. Esto permiti\u00f3 efectivamente que un enlace simb\u00f3lico plantado dentro de un tema o montaje local leyera archivos arbitrarios accesibles para el usuario que ejecuta hugo. Este problema est\u00e1 corregido en la v0.163.1."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "401A6BFD-75B5-4CE4-91C2-EE8A320AA8FB", "versionEndExcluding": "0.163.1", "versionStartIncluding": "0.123.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}