Description

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-26T14:16:54.007Z",
  "pubdate": "2026-09-26T14:16:54.007Z",
  "executiveSummary": "A security flaw exists in the Hugo static site generator, specifically within the security.http.urls configuration, which governs remote resource fetching. The vulnerability is classified as a bypass of IP-literal deny rules caused by improper input validation.\nAffected versions of Hugo (v0.162.0 through v0.165.x) fail to perform case-insensitive checks on URL schemes when enforcing network restrictions. This allows an attacker to bypass intended security constraints by using mixed-case characters in URL schemes passed to the resources.GetRemote function.\nThe primary impact of this vulnerability is Server-Side Request Forgery (SSRF) and unauthorized access to internal network resources or localhost services that were intended to be protected by the Hugo security configuration.\nExploitation requires an attacker to possess the ability to influence the URL parameters processed by the resources.GetRemote function within Hugo templates or content files. By manipulating the URL scheme casing, an attacker can circumvent deny-list filtering mechanisms, potentially leading to unauthorized data exfiltration or interaction with local services reachable from the host machine.\nUsers are at risk if they rely on Hugo's security configuration to restrict remote fetching capabilities in environments where external templates or untrusted user input may influence resource retrieval.",
  "technicalDetails": "The vulnerability resides in the validation logic responsible for the security.http.urls configuration, specifically how Hugo evaluates IP-literal deny rules when processing remote resource requests. The root cause is a case-sensitive string comparison flaw during the evaluation of the protocol scheme within a URL.\nWhen a developer configures Hugo to restrict remote HTTP/HTTPS requests to specific domains or IP ranges, the underlying validation logic attempts to verify if the requested target complies with the defined allow or deny rules. However, the implementation of these rules fails to normalize the input scheme to a standard case (e.g., lowercase) before matching against the security policy.\nThe attack flow proceeds as follows: 1. An attacker identifies a scenario where the resources.GetRemote function is invoked with an attacker-controlled URL. 2. The attacker crafts a request using a non-canonical representation of the protocol scheme, such as 'hTtP://' or 'HtTpS://', targeting a restricted internal IP address or localhost endpoint that is explicitly blocked in the security.http.urls configuration. 3. Because the validation component performs a case-sensitive check, the mixed-case scheme does not match the blocklist criteria. 4. The Hugo resource fetching engine interprets the mixed-case URL as a valid, non-blocked target, bypassing the security policy. 5. The application proceeds to initiate a network request to the restricted destination.\nThis behavior results in a bypass of the security perimeter established by the user. An attacker can leverage this primitive to conduct SSRF attacks, probing internal services or local network infrastructure that is not intended to be exposed to external remote resource requests. The vulnerable component is the Hugo internal network request validator used by resources.GetRemote. This issue affects Hugo versions v0.162.0 up to, but not including, v0.166.0. No specific authentication or privilege escalation is required beyond the ability to trigger the execution of the resources.GetRemote function within the site build process or runtime environment. The impact is limited to the network context of the host executing the Hugo build or server, potentially allowing access to sensitive local APIs or internal management interfaces."
}