CVE-2026-109596: Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

Q: Who is exposed to this issue?

Hugo builds using versions from v0.162.0 before v0.167.0 are exposed when they use a malicious theme or module controlled by an attacker. The issue can disclose local files available to the build environment.

Q: What must an attacker do to exploit it?

The attacker needs control of a Hugo theme or module used during the build. They can place a symlink or NTFS junction at a virtual ancestor directory in a nested mount, causing resources.Match to enumerate and publish files outside the theme or module root.

Q: Is user interaction required?

Yes. The provided vector specifies UI:R, and exploitation depends on a user or build operator incorporating the attacker-controlled theme or module into a Hugo build.

Q: What should teams do if they cannot update immediately?

Do not build with untrusted themes or modules, and review existing theme and module content for symlinks or NTFS junctions in nested-mount ancestor directories. Build in an environment that contains no sensitive files accessible to the Hugo process.

Published Oct 12, 2026

Updated

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

Affected Software

1 affected component

Hugo Hugo>=0.162.0<0.167.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Hugo builds using versions from v0.162.0 before v0.167.0 are exposed when they use a malicious theme or module controlled by an attacker. The issue can disclose local files available to the build environment.

What must an attacker do to exploit it?

The attacker needs control of a Hugo theme or module used during the build. They can place a symlink or NTFS junction at a virtual ancestor directory in a nested mount, causing resources.Match to enumerate and publish files outside the theme or module root.

Is user interaction required?

Yes. The provided vector specifies UI:R, and exploitation depends on a user or build operator incorporating the attacker-controlled theme or module into a Hugo build.

What should teams do if they cannot update immediately?

Do not build with untrusted themes or modules, and review existing theme and module content for symlinks or NTFS junctions in nested-mount ancestor directories. Build in an environment that contains no sensitive files accessible to the Hugo process.

CVE-2026-109596: Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What should teams do if they cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What should teams do if they cannot update immediately?