CVE-2026-109596 — Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ance…
Published: 2026-10-12 · CVSS: 6.7 · CVSS 4.0
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7