DEBIAN-CVE-2026-89258

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-89258
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89258.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-89258
Upstream
Published
2026-09-11T12:16:56Z
Modified
2026-09-12T05:01:03Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

References

Affected packages

Debian:12 / hugo

Package

Name
hugo
Purl
pkg:deb/debian/hugo?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.111.3-1
0.112.7-1
0.113.0-1
0.113.0-2
0.113.0-3
0.114.1-1
0.114.1-2
0.115.4-1
0.116.1-1
0.117.0-1
0.118.2-1
0.119.0-1
0.119.0-2
0.120.3-1
0.120.4-1
0.121.1-1
0.121.2-1
0.122.0-1
0.123.3-1
0.123.7-1
0.123.8-1
0.123.8-2
0.124.1-1
0.125.4-1
0.125.5-1
0.125.6-1
0.125.7-1
0.126.1-1
0.126.2-1
0.126.3-1
0.127.0-1
0.128.2-1
0.128.2-2
0.129.0-1
0.129.0-2
0.130.0-1
0.130.0-2
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7
0.165.0-1
0.165.0-2
0.165.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89258.json"

Debian:13 / hugo

Package

Name
hugo
Purl
pkg:deb/debian/hugo?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7
0.165.0-1
0.165.0-2
0.165.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89258.json"

Debian:14 / hugo

Package

Name
hugo
Purl
pkg:deb/debian/hugo?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.165.0-1

Affected versions

0.*
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89258.json"