CVE-2026-109595: Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hugoto a version that resolves this vulnerability.Fixed in 0.167.0
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Sites that build Hugo projects using untrusted, third-party, or otherwise insufficiently reviewed themes or modules are exposed. The malicious content must be used during a build that invokes js.Build, js.Batch, or css.Build.
What does an attacker need to exploit it?
An attacker needs to supply a malicious theme or module that contains relative imports or symlinks resolving outside the project root. Exploitation also requires user interaction in the form of building the affected Hugo project.
What information can be exposed?
The attacker can cause files readable by the build user to be bundled into published JavaScript or CSS output, including files located outside the project root. The provided information describes confidentiality impact only; it does not indicate integrity or availability impact.
How can I determine whether a project is affected?
A project is affected if it uses Hugo versions from v0.84.0 up to, but not including, v0.167.0 and builds assets with js.Build, js.Batch, or css.Build. Review themes and modules for imports or symlinks that point outside the project directory.