---
id: CVE-2026-50134
title: 'Hugo: security.http.urls allow-list bypass via HTTP redirects'
summary: 'Hugo: security.http.urls allow-list bypass via HTTP redirects'
severity: medium
cwe:
  - CWE-918
vendor: gohugoio
product: github.com/gohugoio/hugo
ecosystem: go
affected:
  - 'github.com/gohugoio/hugo >= 0.91.0, < 0.162.0'
patched:
  - github.com/gohugoio/hugo 0.162.0
published: '2026-06-16'
updated: '2026-06-16'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vxgm-5rmg-5w8g'
references:
  - url: 'https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g'
  - url: >-
      https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
  - url: 'https://github.com/gohugoio/hugo/releases/tag/v0.162.0'
  - url: 'https://github.com/advisories/GHSA-vxgm-5rmg-5w8g'
tags:
  - ghsa
  - go
ingestedAt: '2026-06-29T14:31:47.705Z'
epss: 0.00396
epssPercentile: 0.30984
---

## Overview

**Commit:** [86fbb0f7a8](https://github.com/gohugoio/hugo/commit/86fbb0f7a8) — _security: Validate redirects against security.http.urls_
**Affected versions:** v0.91.0 (when `security.http.urls` was introduced) through v0.161.1.
**Fixed in:** v0.162.0.
**Severity:** Only relevant for sites that rely on `security.http.urls` as a trust boundary — e.g. CI builds that fetch remote resources but want to constrain which hosts can be reached. Not an issue if you fully trust every URL passed to `resources.GetRemote`.

**Description.** `resources.GetRemote` enforces `security.http.urls` on the URL it is called with, but until v0.162.0 it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid — for example, `http://localhost/` or an internal IP — and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place.

**Mitigation.** v0.162.0 installs a `CheckRedirect` on the HTTP client used by `resources.GetRemote` that re-runs `security.http.urls` on every redirect target and caps the redirect chain at 10 hops. No configuration change is required.

## Affected packages

- `github.com/gohugoio/hugo >= 0.91.0, < 0.162.0`

## Remediation

Upgrade to a patched release:

- `github.com/gohugoio/hugo 0.162.0`