CVE-2026-109596: Hugo Path Traversal Vulnerability

CVE-2026-109596 Overview

CVE-2026-109596 is an improper link resolution vulnerability [CWE-59] in the Hugo static site generator. Affected versions span v0.162.0 through versions before v0.167.0. A malicious theme or module can place a symlink or NTFS junction at a virtual ancestor directory of a nested mount. When Hugo builds the site, resources.Match resolves the link and lists files outside the project root. Those files are then published into the generated site. The flaw enables local file disclosure during builds that consume untrusted themes or modules.

Critical Impact
A theme or module author can exfiltrate arbitrary files readable by the build user through the generated site output.

Affected Products

Hugo v0.162.0 through versions prior to v0.167.0
Deployments consuming third-party Hugo themes or modules
Build pipelines on Windows (NTFS junctions) and Unix-like systems (symlinks)

Discovery Timeline

2026-10-12 - CVE-2026-109596 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109596

Vulnerability Analysis

Hugo supports module and theme composition through nested mounts that map external directories into the virtual project filesystem. The resource matcher walks these mount points to enumerate assets that pipelines such as resources.Match consume during site generation.

In versions v0.162.0 to v0.167.0, Hugo does not correctly validate link targets at ancestor directories of a nested mount. A theme or module author can introduce a symbolic link, or an NTFS junction on Windows, at a virtual path that sits above the module's declared root. When Hugo resolves the path during a build, it follows the link to a location outside the sandboxed project tree.

The matcher then enumerates files reachable through that link and treats them as publishable resources. Any file readable by the account running hugo can be copied into the output directory and served from the deployed site. This exposes build secrets, CI environment files, SSH keys, and source code that happens to sit alongside the project.

Root Cause

The root cause is improper link resolution during mount traversal. Hugo trusts the virtual path hierarchy defined by modules and does not restrict link targets to the module's own root. The check that would reject symlinks pointing to ancestor or sibling directories is missing for nested-mount scenarios, so the resolver dereferences attacker-controlled links without a containment boundary.

Attack Vector

Exploitation requires a victim to build a site that includes a malicious theme or module and requires local user interaction to initiate that build. The attacker publishes a Hugo theme or module containing a crafted directory layout and a symlink or junction placed at a virtual ancestor directory of a nested mount. When the maintainer runs hugo or hugo server, the matcher resolves the link, enumerates external files, and includes them in the build output. Attacker-controlled themes are the primary delivery mechanism, so supply-chain trust in theme sources is the pivot point.

See the GitHub Security Advisory GHSA-6c8w-mpp8-9w47 and the VulnCheck Advisory for Hugo for additional technical detail.

Detection Methods for CVE-2026-109596

Indicators of Compromise

Symbolic links or NTFS junctions inside imported theme or module directories that resolve to paths outside the theme root.
Unexpected files such as .env, id_rsa, or .git/config appearing in the public/ output directory after a build.
Build logs showing resources.Match enumerations that reference ancestor paths of a nested mount.

Detection Strategies

Audit vendored themes and the module cache under $HOME/.hugo_cache or the configured module directory for symlinks and junctions.
Diff the generated public/ tree against the expected content inventory to flag files that do not originate from site templates.
Pin Hugo module versions and verify checksums with go.sum to detect substitution of a theme by a malicious release.

Monitoring Recommendations

Alert on CI jobs that read filesystem paths outside the repository checkout during hugo invocations.
Monitor build artifacts for sensitive filename patterns before deployment publishes them to a CDN or web host.
Record the Hugo binary version used by each build so pipelines running affected releases can be identified quickly.

How to Mitigate CVE-2026-109596

Immediate Actions Required

Upgrade Hugo to v0.167.0 or later across all developer workstations and CI runners.
Inventory active themes and modules, and remove any sourced from untrusted authors.
Rotate credentials, tokens, and keys that may have been exposed in build outputs produced by vulnerable Hugo versions.

Patch Information

The fix is included in Hugo v0.167.0. Refer to the GitHub Security Advisory GHSA-6c8w-mpp8-9w47 for the upstream patch and release notes. Update dependency manifests and rebuild container images that bundle the Hugo toolchain.

Workarounds

Run hugo builds inside a sandbox or container with no access to secrets or files outside the project directory.
Review every theme and module for symlinks and junctions before use, and reject any that reference ancestor paths.
Use a dedicated build user with filesystem permissions limited to the project tree until the upgrade is deployed.

bash

# Verify installed Hugo version and upgrade
hugo version

# Example: upgrade via Go install
go install github.com/gohugoio/hugo@v0.167.0

# Scan a theme directory for symlinks before building
find themes/ -type l -print