CVE-2026-100690: Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hugoto a version that resolves this vulnerability.Fixed in v0.166.0
Event History
Frequently Asked Questions
Which Hugo builds are exposed in practice?
Versions v0.161.0 through v0.165.0 are affected when the build invokes Node.js tools such as css.PostCSS, css.TailwindCSS, or js.Babel. Projects that do not invoke these tools are unaffected.
What access does an attacker need to exploit this?
The attacker must be able to contribute content to the Hugo project, such as by submitting a pull request that introduces a symlink and a PostCSS plugin. No additional Hugo permissions are described.
Are default settings affected?
Yes. The issue affects builds using Hugo's default security configuration when they invoke the affected Node.js tools.
What is the impact of a successful exploit?
An attacker can cause the build process to read files outside the project or configured mounts if those files are readable by the Hugo build process. The disclosed content may be embedded in the published site.
What should teams do if they cannot patch immediately?
Do not run affected Node.js tools for untrusted project contributions, and review contributed symlinks and build plugins for paths that resolve outside allowed project directories or mounts. Upgrading to v0.166.0 makes Hugo scan allowed paths and fail builds when a symlink resolves outside them.