Medium 6.3Published Sep 11, 2026

CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Updated under an hour ago (2026-10-19 10:10 UTC)

Does this affect you?

It affects gohugoio hugo. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for gohugoio hugo

Exploited in the last 30 days

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

CVSS: 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Sep 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

gohugoio hugo gohugoio:hugo (from the name)	before 0.165.0; 0.165.0 not affected	CNA record

References

https://github.com/gohugoio/hugo/security/advisories/GHSA-vrv5-r5rf-6v4jvendor-advisory
https://www.vulncheck.com/advisories/hugo-before-0.165.0-symlink-confinement-bypass-via-resources-getthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.