CVE-2026-100693: Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gohugoio/hugoto a version that resolves this vulnerability.Fixed in 0.166.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hugo installations running versions from v0.162.0 up to, but not including, v0.166.0 are affected when they use resources.GetRemote and rely on the security.http.urls IP-literal deny rule to prevent access to restricted addresses.
What does an attacker need to exploit the bypass?
An attacker needs a way to cause a resources.GetRemote call to use a mixed-case URL scheme. The mixed-case scheme can bypass the case-sensitive IP-literal validation and allow fetching from restricted IP addresses such as localhost.
Does this affect Hugo's default configuration?
The available information identifies exposure specifically where the security.http.urls IP-literal deny rule is relied upon. It does not state whether that rule is enabled or effective in Hugo's default configuration.
How can I determine whether an installation is affected?
Check whether the Hugo version is v0.162.0 or later but earlier than v0.166.0, and review templates or other content paths for resources.GetRemote usage. Prioritize cases where remote URLs may be influenced by untrusted input and IP-literal deny rules are used to restrict localhost or other internal addresses.