CVE-2026-58403: Hugo symlink confinement bypass in os.ReadFile
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v0.163.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58403?
The severity of CVE-2026-58403 is classified as medium with a CVSS score of 5.9.
How do I fix CVE-2026-58403?
To fix CVE-2026-58403, update Hugo to version 0.163.1 or later where this vulnerability has been addressed.
What are the risks associated with CVE-2026-58403?
CVE-2026-58403 poses a risk of symlink confinement bypass, potentially allowing access to files outside of the intended directory structure.
Which versions of Hugo are affected by CVE-2026-58403?
CVE-2026-58403 affects Hugo versions from 0.123.0 through 0.163.0.
What is the main issue with CVE-2026-58403?
The main issue with CVE-2026-58403 is a regression that causes the Stat function to follow symlinks, allowing unintended file access.