CVE-2026-50134
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Hugo from version 0.91.0 to 0.162.0, the resources.GetRemote function does not re-validate destination URLs after HTTP 3xx redirects, allowing bypass of the security.http.urls policy. An attacker can redirect the request to a forbidden host, and Hugo will fetch from it.
Risk Assessment
The organization may unknowingly fetch content from untrusted or forbidden servers, leading to policy violations and potential injection of malicious data into the generated site.
Recommendation
Upgrade Hugo to version 0.162.0 or later immediately, which includes a fix that re-validates URLs after redirects.
Original NVD description (English source)
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.