Description

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:53.860Z",
  "pubdate": "2026-09-26T14:16:53.860Z",
  "executiveSummary": "This vulnerability is a path traversal flaw residing in Hugo static site generator versions v0.123.0 through v0.165.0. The vulnerability originates from insufficient symlink confinement checks within the module and theme mounting mechanism. By leveraging symlinks located at mount roots—specifically within the themes/ directory or vendored module paths—an attacker can bypass security restrictions intended to limit file access to local module paths.\nThe impact allows for unauthorized file system access during the site build process. Sensitive files located outside the intended project directory can be read via functions such as resources.Get and resources.Match, or exposed publicly if included in static mounts. The risk is significant for developers utilizing untrusted themes or modules, as these can serve as vectors to exfiltrate local system data or source code. Exploitation does not require network interaction in a traditional sense; rather, it is triggered during the site build execution if a malicious symlink is present within the project's dependency tree. The vulnerability is mitigated by upgrading to v0.166.0, where stricter symlink validation is enforced.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of symlink validation logic within Hugo's module mounting system. In affected versions (v0.123.0 up to v0.166.0), the application's confinement checks failed to resolve symlinks beyond the mount root boundary. This effectively permitted a symlink placed at a mount root to point to an arbitrary location on the host file system (e.g., /etc/passwd or other sensitive directories).\nThe vulnerable component is the Hugo module resolution and file system abstraction layer. When Hugo processes themes or vendored modules, it relies on these mount points to map project-relative directories to their respective source locations. Because the validation mechanism only verified the mount root itself and neglected the target of potential symlinks, it allowed 'jailbreaking' the intended project directory hierarchy.\nThe attack flow proceeds as follows: First, a malicious actor introduces a symlink into the themes/ or vendored modules directory (e.g., themes/malicious-theme/assets -> /sensitive/directory). Second, during the site build process, Hugo's resource management functions, including resources.Get and resources.Match, resolve these symlinks while processing the assets. Because the symlink is treated as a valid mount point, Hugo follows the link, traversing into the sensitive directory. Third, the build process treats the contents of the target directory as part of the site's resource pool. Consequently, these files can be explicitly referenced in site templates or, if configured via static mounts, be published directly into the public/ directory. This makes the sensitive data accessible to any user visiting the rendered website.\nThis vulnerability specifically affects locally stored themes and vendored modules. Modules fetched through the official Go modules ecosystem remain secure, as Go module zip archives do not support symlink extraction, preventing the injection of such links. This issue does not constitute a privilege escalation for the main project configuration, as the primary project setup is assumed to have legitimate access to absolute paths through configuration. The vulnerability represents an escalation of privilege for malicious or compromised third-party dependencies within the project directory. The fix introduced in v0.166.0 enforces a strict policy: any symlink found at a mount root or within the directory hierarchy between the mount root and the module directory is programmatically treated as non-existent, effectively nullifying the traversal capability."
}