CVE-2026-89258

Hugo versions after v0.123.0 and before v0.165.0 did not drop symlinks in parent directories during direct resource lookups, allowing the generator's path confinement to be bypassed (CWE-59). An attacker who can place a symlink inside a mounted directory — or convince a site author to do so, for example in a locally vendored theme under themes/ — can cause direct-lookup functions such as resources.Get and os.ReadFile to follow the link and read files outside the intended project boundaries. The contents of those external files are then disclosed in the built site. Only Hugo sites building from locally mounted directories that contain symlinks are affected: themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are unaffected, and multi-directory walks (e.g., content/asset walking) are also unaffected. No public proof-of-concept or known exploitation exists, the issue is not in CISA KEV, and the flaw is fixed in Hugo v0.165.0 as an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw.

What to do: Upgrade to Hugo v0.165.0 or later, which drops parent-directory symlinks during direct resource lookups. Until then, audit locally vendored themes and any mounted directories (especially themes/) for symlinks pointing outside the project and remove or replace them, or switch to themes mounted as Go modules fetched from GitHub, which have symlinks stripped on download. This fix completes the earlier path-confinement fixes GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw, so confirm those are also applied.