CVE-2026-58403
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.
Risk Assessment
An attacker can exploit this to read sensitive system or configuration files by planting a malicious symlink in a theme or local mount point. This could lead to data leakage or privilege escalation.
Recommendation
Upgrade Hugo to version 0.163.1 or later immediately. If upgrading is not possible, avoid using untrusted themes and inspect all symbolic links in mounted directories.
Original NVD description (English source)
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.