Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck
CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
Medium 6.3
In plain English
A medium-severity security flaw in hugo from gohugoio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hugo | no fix listed | DEBIAN-CVE-2026-89258 |
| Debian:13 | hugo | no fix listed | DEBIAN-CVE-2026-89258 |
| Debian:14 | hugo | 0.165.0-1 | DEBIAN-CVE-2026-89258 |
| Ubuntu:22.04:LTS | hugo | no fix listed | UBUNTU-CVE-2026-89258 |
| Ubuntu:26.04:LTS | hugo | no fix listed | UBUNTU-CVE-2026-89258 |
| Ubuntu:26.10 | hugo | no fix listed | UBUNTU-CVE-2026-89258 |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-vrv5-r5rf-6v4j) vendor-advisory
- VulnCheck Advisory: Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get third-party-advisory