CVE-2026-58403Medium▾ SunlitHugo: Symlink confinement bypass in os.ReadFile
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.5%
Affected versions: v0.123.0 through v0.163.0. Earlier versions are not affected.
Fixed in: v0.163.1.
Severity: Medium. Requires the attacker to be able to place (or convince a site author to place) a symlink inside a mounted directory — for example, inside a locally-vendored theme under themes/. Themes mounted as Go modules from GitHub have symlinks stripped on download and are not affected. Multi-directory walks (e.g. content/asset walking) were not affected either; only direct lookups via resources.Get followed symlinks.
Description. Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree. A regression introduced in v0.123.0 caused RootMappingFs.statRoot to call Stat (which follows symlinks) instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo.
github.com/gohugoio/hugo >= 0.123.0, < 0.163.1Upgrade to a patched release:
github.com/gohugoio/hugo 0.163.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44301MediumHugo's Node tool execution allows file system access outside the project directory
CVE-2026-58404HighHugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
CVE-2026-58402MediumHugo: XSS via unescaped code-fence language in default code block renderer
CVE-2026-35166MediumHugo: Certain markdown links are not properly escaped
GHSA-c3wq-j5vh-68rcMediumHugo: Symlink confinement bypass in os.ReadFile
CVE-2020-26284High· 7.7Hugo can execute a binary from the current directory on Windows