CVE-2026-109574: Hugo CSS Path Traversal Vulnerability

CVE-2026-109574 Overview

CVE-2026-109574 is a path traversal vulnerability [CWE-22] in the Hugo static site generator affecting versions prior to v0.167.0. The flaw resides in the css.Sass function, where the Sass compiler's import fallback resolves @import and @use targets outside the intended project root. Malicious themes or modules can ship stylesheets with relative, absolute, or symlinked import targets. When Hugo compiles the site, the referenced files are read from disk and embedded into the published CSS output.

Critical Impact
An attacker who convinces a developer to build a site using a malicious Hugo theme or module can exfiltrate arbitrary readable files from the build host by embedding their contents into the generated site CSS.

Affected Products

Hugo static site generator versions before v0.167.0
Projects importing untrusted Hugo themes that invoke css.Sass
Projects importing untrusted Hugo modules that provide SCSS assets

Discovery Timeline

2026-10-12 - CVE-2026-109574 published to the National Vulnerability Database (NVD)
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-109574

Vulnerability Analysis

Hugo exposes a Sass compilation pipeline through the css.Sass template function, which processes SCSS files supplied by project assets, themes, or modules. The compiler supports @import and @use directives that reference external stylesheets. In vulnerable releases, when the primary resolver fails to locate an import target inside the project asset tree, a fallback resolver attempts to open the path directly on the local filesystem.

The fallback does not constrain the resolved path to the project root. Relative traversal sequences, absolute paths, and symbolic links are all accepted. Any file the Hugo process can read is loaded by the Sass engine and emitted into the compiled stylesheet. A hostile theme shipped through the Hugo module registry, a Git submodule, or a package install can therefore exfiltrate secrets, SSH keys, environment files, or source code from the build environment.

Root Cause

The root cause is missing path containment in the Sass import fallback within css.Sass. The resolver treats user-controlled import strings as trusted filesystem paths rather than normalizing them against the project root and rejecting references that escape it.

Attack Vector

Exploitation requires a victim to build a Hugo site that includes attacker-controlled SCSS content. The attack vector is local because it depends on a developer or build pipeline executing hugo against a repository that pulls in a malicious theme or module. User interaction is required to trigger the build. Successful exploitation yields file read primitives bounded by the privileges of the Hugo build process, and the exfiltrated data is delivered through the generated CSS output.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-3jfr-vjcq-7jvf and the VulnCheck Advisory for Hugo Path Traversal for technical references.

Detection Methods for CVE-2026-109574

Indicators of Compromise

SCSS source files containing @import or @use directives with relative traversal sequences such as ../, absolute filesystem paths, or references outside the assets/ and themes/ directories.
Symbolic links inside theme or module directories that point to locations outside the project root.
Generated CSS artifacts containing fragments of configuration files, private keys, or environment variables that have no legitimate stylistic purpose.

Detection Strategies

Scan Hugo theme and module repositories for SCSS import directives referencing paths outside the project asset tree before invoking hugo in CI.
Review the published public/ directory for CSS output containing non-stylistic content, including shell-style key-value pairs or PEM headers.
Audit the Hugo version pinned in build pipelines and fail builds using versions earlier than v0.167.0.

Monitoring Recommendations

Instrument build runners to log filesystem reads performed by the Hugo process and alert on reads outside the project working directory.
Track dependency changes in go.mod, hugo.toml, and themes/ submodules to detect introduction of untrusted third-party content.

How to Mitigate CVE-2026-109574

Immediate Actions Required

Upgrade Hugo to v0.167.0 or later across all developer workstations and build pipelines.
Inventory existing projects for third-party themes and modules obtained outside the official Hugo themes gallery and remove untrusted sources.
Rotate any secrets that may have been exposed through published CSS artifacts generated by vulnerable Hugo builds.

Patch Information

The maintainers resolved the issue in Hugo v0.167.0 by constraining the Sass import fallback to the project asset tree. Details are available in the GitHub Security Advisory GHSA-3jfr-vjcq-7jvf.

Workarounds

Build Hugo sites only inside ephemeral, least-privilege containers that contain no secrets, SSH keys, or sensitive source outside the project directory.
Vendor and review all theme and module SCSS files before use, rejecting any @import or @use targets that reference paths outside the project root.
Restrict the filesystem permissions of the user account that runs hugo so it cannot read sensitive host paths.

bash

# Verify installed Hugo version and upgrade if below v0.167.0
hugo version

# Example: upgrade via Go install
go install github.com/gohugoio/hugo@v0.167.0