Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
References
| Link | Resource |
|---|---|
| https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229 | Patch |
| https://github.com/gohugoio/hugo/pull/15020 | Issue Tracking |
| https://github.com/gohugoio/hugo/releases/tag/v0.163.1 | Release Notes |
| https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc | Vendor Advisory |
Configurations
History
08 Jul 2026, 03:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229 - Patch | |
| References | () https://github.com/gohugoio/hugo/pull/15020 - Issue Tracking | |
| References | () https://github.com/gohugoio/hugo/releases/tag/v0.163.1 - Release Notes | |
| References | () https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc - Vendor Advisory | |
| First Time |
Gohugo hugo
Gohugo |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:* |
06 Jul 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-06 20:16
Updated : 2026-07-08 03:05
NVD link : CVE-2026-58403
Mitre link : CVE-2026-58403
CVE.ORG link : CVE-2026-58403
JSON object : View
Products Affected
gohugo
- hugo
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')