CVE-2026-109595: Hugo Path Traversal Vulnerability

CVE-2026-109595 Overview

CVE-2026-109595 is a path traversal vulnerability [CWE-22] in the Hugo static site generator affecting versions v0.84.0 through versions before v0.167.0. The flaw resides in ESBuild's fallback resolver used by js.Build, js.Batch, and css.Build. Malicious themes or modules can supply relative imports or symlinks that reference files outside the project root. The build process then reads those files and bundles their contents into published JavaScript or CSS output. Any file readable by the user running the Hugo build becomes accessible to an attacker who later retrieves the published assets.

Critical Impact
Untrusted themes or modules can exfiltrate arbitrary files from the build environment, including source code, credentials, SSH keys, and CI/CD secrets, by embedding them into published site assets.

Affected Products

Hugo static site generator versions v0.84.0 through versions prior to v0.167.0
Projects consuming third-party Hugo themes that invoke js.Build, js.Batch, or css.Build
Projects consuming third-party Hugo modules that invoke js.Build, js.Batch, or css.Build

Discovery Timeline

2026-10-12 - CVE-2026-109595 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109595

Vulnerability Analysis

Hugo integrates ESBuild to transform JavaScript and CSS assets through the js.Build, js.Batch, and css.Build template functions. When ESBuild cannot resolve an import using Hugo's project-aware resolver, it falls back to its native resolver. The fallback resolver does not enforce Hugo's project root boundary. An attacker-controlled theme or module can therefore issue relative imports that traverse upward from the theme directory, or place symlinks pointing at files anywhere on the build host's filesystem.

The resolved files are read by the build user and inlined into the generated bundle. The output is then written to the published site. Attackers retrieve the exfiltrated contents by downloading the public JavaScript or CSS files.

Root Cause

The root cause is missing path validation on files resolved through ESBuild's fallback resolver. Hugo passes resolution responsibility to ESBuild without verifying that the resolved file paths remain within the project root. Symlink targets are followed without equivalent validation. This matches the pattern described by CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires a build operator to run Hugo against an attacker-controlled theme or module. The attack vector is local and user interaction is required, since the victim must install or update the malicious dependency and invoke a build. Once triggered, the build process reads any file the user account can access and writes those contents into published artifacts. Common targets include .env files, ~/.ssh/id_rsa, cloud credential files such as ~/.aws/credentials, and CI runner secrets available on the build host.

Technical details are documented in the GitHub Security Advisory GHSA-r4xx-89rf-5424 and the VulnCheck Advisory for Hugo Path Traversal.

Detection Methods for CVE-2026-109595

Indicators of Compromise

Published JavaScript or CSS bundles containing strings that resemble private keys, API tokens, or environment variable blocks.
Symbolic links inside theme or module directories whose targets resolve outside the project root.
Hugo module imports using relative paths that traverse upward with ../ sequences from theme asset directories.
Unexpected growth in bundle size after adding or updating a third-party theme or module.

Detection Strategies

Scan generated public/ output for high-entropy strings and known secret patterns prior to deployment.
Enumerate symlinks under themes/ and node_modules/ consumed by Hugo and verify each target resolves within the project root.
Review the Hugo version used across repositories and CI pipelines; flag any version at or above v0.84.0 and below v0.167.0.
Diff published assets against the previous build to identify unexpected file inlining introduced by theme or module updates.

Monitoring Recommendations

Track Hugo version pins across all repositories through software composition analysis.
Monitor CI/CD logs for build processes reading files outside the repository workspace.
Alert on git commits that introduce new themes, modules, or symlinks in asset directories.

How to Mitigate CVE-2026-109595

Immediate Actions Required

Upgrade Hugo to v0.167.0 or later on all developer workstations and CI/CD build runners.
Audit third-party themes and modules currently in use and verify their source and integrity.
Rotate any secrets that were readable by the build user if untrusted themes or modules were ever built.
Re-scan previously published JavaScript and CSS output for inlined sensitive content.

Patch Information

The vulnerability is fixed in Hugo v0.167.0. Upgrade using the official release channel. See the GitHub Security Advisory GHSA-r4xx-89rf-5424 for release details and reviewer notes.

Workarounds

Build Hugo sites inside an isolated container or sandbox where only the project directory is mounted and no secrets are present.
Run builds under a dedicated unprivileged user account with no access to host credentials, SSH keys, or environment secrets.
Avoid using untrusted or unaudited third-party themes and modules until the upgrade is applied.
Remove or disable use of js.Build, js.Batch, and css.Build in templates that depend on third-party code until patched.

bash

# Verify installed Hugo version and upgrade
hugo version

# Example container-based isolated build
docker run --rm \
  -v "$PWD":/src:ro \
  -v "$PWD/public":/src/public \
  -w /src \
  --user 1000:1000 \
  --network none \
  hugomods/hugo:0.167.0 hugo --minify