CVE-2026-50135
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.
Risk Assessment
An attacker can exploit a symlink in a theme or other local resource to read arbitrary files accessible to the Hugo user, leading to sensitive data exposure.
Recommendation
Upgrade Hugo to version 0.162.0 or later, which fixes the regression by restoring the use of Lstat.
Original NVD description (English source)
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.