CVE-2026-100690: Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Published Sep 26, 2026
·
Updated

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

Affected Software

1 affected component
Hugo Hugo>=0.161.0<=0.165.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Hugo to a version that resolves this vulnerability.

    Fixed in v0.166.0

Event History

Sep 26, 2026
CVE Published
via MITRE·01:23 PM
Data Sourced
via MITRE·01:23 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which Hugo builds are exposed in practice?

Versions v0.161.0 through v0.165.0 are affected when the build invokes Node.js tools such as css.PostCSS, css.TailwindCSS, or js.Babel. Projects that do not invoke these tools are unaffected.

2

What access does an attacker need to exploit this?

The attacker must be able to contribute content to the Hugo project, such as by submitting a pull request that introduces a symlink and a PostCSS plugin. No additional Hugo permissions are described.

3

Are default settings affected?

Yes. The issue affects builds using Hugo's default security configuration when they invoke the affected Node.js tools.

4

What is the impact of a successful exploit?

An attacker can cause the build process to read files outside the project or configured mounts if those files are readable by the Hugo build process. The disclosed content may be embedded in the published site.

5

What should teams do if they cannot patch immediately?

Do not run affected Node.js tools for untrusted project contributions, and review contributed symlinks and build plugins for paths that resolve outside allowed project directories or mounts. Upgrading to v0.166.0 makes Hugo scan allowed paths and fail builds when a symlink resolves outside them.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203