CVE-2026-100692: Hugo Information Disclosure Vulnerability

CVE-2026-100692 Overview

CVE-2026-100692 is a path traversal vulnerability in Hugo, a widely used static site generator written in Go. The flaw affects versions after v0.123.0 and before v0.166.0. Hugo's symlink confinement checks stopped at the mount root, allowing a theme or vendored module to place a symlink at a mount root pointing outside the project. Files behind such a symlink became readable during site builds through resources.Get, resources.Match, and similar functions. Attackers could also publish those files to public/ via static mounts, bypassing the restriction that theme and module mount sources must be local paths.

Critical Impact
A malicious or compromised theme or vendored module can exfiltrate arbitrary files from the build host and publish them to the generated site output.

Affected Products

Hugo versions after v0.123.0 and before v0.166.0
Projects consuming themes checked into themes/
Projects consuming vendored modules

Discovery Timeline

2026-09-26 - CVE-2026-100692 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100692

Vulnerability Analysis

The vulnerability is a symlink-based path traversal classified as [CWE-59] Improper Link Resolution Before File Access. Hugo mounts theme and module directories to make their contents available to the build pipeline. The engine enforced that mount sources must be local paths relative to the project. However, the confinement check validated paths starting from the mount root itself, not the symlinks that defined it. A theme shipped in themes/mytheme/ could include a symlink such as themes/mytheme/assets -> /some/dir/outside, and Hugo would follow it during resource resolution.

Once resolved, any file reachable through the symlink was treated as a legitimate project asset. Build-time functions like resources.Get and resources.Match read these files, and static mounts could copy them into the published public/ output directory. Modules fetched via the Go module system are not affected because Go module zip archives cannot contain symlinks.

Root Cause

Hugo's path confinement logic validated resolved paths relative to the mount root but did not inspect the mount root itself or intermediate directories for symbolic links. This left a gap where a symlink placed at or above the mount boundary was silently followed instead of rejected.

Attack Vector

Exploitation requires a project to consume a malicious or compromised theme or vendored module containing a symlink at a mount root. During the build, Hugo follows the symlink and exposes files from arbitrary host paths. The attack is remotely reachable in supply-chain scenarios where themes are pulled from untrusted sources. This is not an escalation for the main project, which may already configure absolute path mounts intentionally.

See the GitHub Security Advisory GHSA-797m-7j5g-3rpr and the VulnCheck Advisory on Hugo for additional technical context.

Detection Methods for CVE-2026-100692

Indicators of Compromise

Symbolic links present at or near mount roots inside themes/ or vendored module directories, especially pointing to absolute paths outside the project root.
Unexpected files appearing in the generated public/ directory that originate from host filesystem locations such as /etc, /home, or CI secrets paths.
Hugo build logs showing resource resolution for assets that do not exist as regular files in the repository tree.

Detection Strategies

Scan repository checkouts and CI workspaces for symlinks using find themes/ -type l and equivalent commands against any vendored module directory.
Compare the file inventory of public/ after each build against the known static asset manifest to flag unexpected additions.
Audit third-party themes and modules on ingestion, rejecting any archive or repository that contains symbolic links at mount boundaries.

Monitoring Recommendations

Instrument CI/CD pipelines to fail builds when symlinks are detected in themes/ or vendored module paths prior to invoking Hugo.
Track the installed Hugo version across build agents and alert when any agent runs a release older than v0.166.0.
Review access patterns to sensitive filesystem locations from the Hugo build process using host-based auditing such as auditd or eBPF-based file access telemetry.

How to Mitigate CVE-2026-100692

Immediate Actions Required

Upgrade Hugo to v0.166.0 or later on all build systems, developer workstations, and CI runners.
Inventory every theme in themes/ and every vendored module, then inspect each for symlinks at mount roots or intermediate directories.
Rebuild and republish any sites produced by vulnerable Hugo versions after confirming no sensitive host files were leaked into public/.

Patch Information

Hugo v0.166.0 fixes the issue by treating symlinked mount roots and symlinked directories between the mount root and the module directory as non-existent for all modules. Refer to the GitHub Security Advisory GHSA-797m-7j5g-3rpr for the full fix description.

Workarounds

Inspect themes/ and vendored modules for symlinks at mount roots before building, and reject any that contain them.
Replace symlinks with explicit mount declarations in the site configuration so paths are reviewed and approved rather than silently followed.
Prefer modules distributed via the Go module system, which cannot carry symlinks in their zip archives.

bash

# Identify symlinks in themes and vendored modules before building
find themes/ -type l -print
find _vendor/ -type l -print 2>/dev/null

# Verify installed Hugo version meets the fixed release
hugo version | grep -E 'v0\.(1(6[6-9]|[7-9][0-9])|[2-9][0-9]{2})'