CVE-2026-100693 — Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions.…
Published: 2026-09-26 · CVSS: 8.6 · CVSS 4.0
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7