CVE-2026-109596

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109596
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109596.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109596
Aliases
  • GHSA-6c8w-mpp8-9w47
Downstream
Published
2026-10-12T22:21:51Z
Modified
2026-10-13T10:48:20Z
Severity
  • 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
Details

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109596.json"
}
References

Affected packages

Git / github.com/gohugoio/hugo

Affected ranges

Type
GIT
Repo
https://github.com/gohugoio/hugo
Events
Introduced
076dfe13d0f789e3d9586b192f8f7f3329c26990
Fixed
3fff6fb5c267dacb26280c78dbe8c344054249c8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.162.0"
        },
        {
            "fixed":  "0.167.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.162.0
v0.162.1
v0.163.0
v0.163.1
v0.163.2
v0.163.3
v0.164.0
v0.165.0
v0.166.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109596.json"