DEBIAN-CVE-2026-58403

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-58403
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58403.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-58403
Upstream
Published
2026-07-06T20:16:38Z
Modified
2026-09-14T17:03:21Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

References

Affected packages

Debian:13 / hugo

Package

Name
hugo
Purl
pkg:deb/debian/hugo?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7
0.165.0-1
0.165.0-2
0.165.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58403.json"

Debian:14 / hugo

Package

Name
hugo
Purl
pkg:deb/debian/hugo?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.165.0-1

Affected versions

0.*
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58403.json"