CVE-2026-58403: Hugo Path Traversal Vulnerability

CVE-2026-58403 Overview

CVE-2026-58403 is a symlink following vulnerability [CWE-59] in Hugo, the popular Go-based static site generator. The flaw affects versions v0.123.0 through v0.163.0 and stems from a regression in Hugo's virtual filesystem layer. Specifically, RootMappingFs.statRoot calls Stat instead of Lstat, causing the resolver to follow symlinks that reference paths outside the mount tree. A symlink planted inside a theme or local mount can read arbitrary files accessible to the user running hugo. The issue is fixed in v0.163.1.

Critical Impact
A malicious theme or mounted content can exfiltrate arbitrary files readable by the Hugo process, including source code, SSH keys, and environment secrets on build systems.

Affected Products

Hugo v0.123.0 through v0.163.0
Projects consuming untrusted Hugo themes or third-party modules
CI/CD build environments running vulnerable Hugo versions

Discovery Timeline

2026-07-06 - CVE-2026-58403 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58403

Vulnerability Analysis

Hugo implements a virtual filesystem layer that composes multiple content roots into a unified tree. The abstraction, RootMappingFs, is designed to prevent files under a mount from resolving paths outside that mount. This containment property is a security boundary relied on by theme and module consumers.

The regression occurred in the statRoot method. The function calls os.Stat, which transparently resolves symbolic links to their target. The correct call is os.Lstat, which returns metadata for the link itself without dereferencing. Because of this substitution, a direct os.ReadFile("somefile") where somefile is a symlink pointing outside the mount returns the target's contents.

This behavior maps to [CWE-59] Improper Link Resolution Before File Access. Adoption of untrusted themes or content modules is common in the Hugo ecosystem, expanding the exposed attack surface.

Root Cause

The root cause is the incorrect use of Stat instead of Lstat inside RootMappingFs.statRoot. Stat follows symlinks by design, so any containment check performed on the returned metadata reflects the target file rather than the link. The virtual filesystem then treats the resolved path as if it were legitimately inside the mount.

Attack Vector

An attacker publishes a malicious Hugo theme, module, or content bundle containing a symbolic link. When a developer installs the theme and runs hugo build, the symlink is dereferenced and the target file is included in the build pipeline. The attacker can then exfiltrate the file content through generated pages, template output, or build logs.

text

# Patch: bump github.com/bep/overlayfs to drop symlinks in
# os.ReadDir, os.ReadFile, os.Stat and os.FileExists

 	github.com/bep/lazycache v0.8.1
 	github.com/bep/logg v0.4.0
 	github.com/bep/mclib v1.20401.20400
-	github.com/bep/overlayfs v0.10.0
+	github.com/bep/overlayfs v0.11.0
 	github.com/bep/simplecobra v0.7.0
 	github.com/bep/textandbinarywriter v0.1.0
 	github.com/bep/tmc v0.6.0

# Source: https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229

Detection Methods for CVE-2026-58403

Indicators of Compromise

Symbolic links inside theme directories (themes/), module caches, or mounted content paths that resolve to targets outside the project root.
Unexpected file content appearing in built site output referencing paths such as /etc/passwd, ~/.ssh/, or CI environment files.
Build logs showing reads of files outside the project working directory.

Detection Strategies

Audit installed themes and modules with find themes/ -type l -exec ls -la {} \; to enumerate all symlinks and their targets.
Inspect the Hugo module cache under $GOPATH/pkg/mod/ for symlinks referencing absolute paths.
Diff generated public output against expected structure to identify unexpected file inclusions.

Monitoring Recommendations

Log filesystem access from the hugo process during CI builds and alert on reads outside the project directory.
Track Hugo versions across build agents and flag any host running versions between v0.123.0 and v0.163.0.
Monitor commits that add third-party themes or modules for supply chain review before merging.

How to Mitigate CVE-2026-58403

Immediate Actions Required

Upgrade Hugo to v0.163.1 or later on all developer workstations and CI runners.
Audit all installed themes and modules for untrusted origin, and remove any containing symbolic links.
Run Hugo builds under a restricted user account with no access to sensitive files like SSH keys or CI secrets.

Patch Information

The fix ships in Hugo Release v0.163.1. The remediation upgrades the github.com/bep/overlayfs dependency from v0.10.0 to v0.11.0, which drops symlinks in os.ReadDir, os.ReadFile, os.Stat, and os.FileExists. See the GitHub Security Advisory GHSA-c3wq-j5vh-68rc and the upstream commit for full technical detail.

Workarounds

Pin Hugo builds to sandboxed containers with read-only mounts limited to the project directory.
Manually scan theme and module directories for symlinks before running hugo build and reject any that resolve outside the project.
Use dedicated CI service accounts that hold no secrets, SSH keys, or cross-project filesystem access.

bash

# Upgrade Hugo and verify the fixed version
go install github.com/gohugoio/hugo@v0.163.1
hugo version

# Enumerate symlinks in themes and modules before building
find themes/ -type l -exec ls -la {} \;
find $(go env GOPATH)/pkg/mod/github.com/\!gohugo\!io -type l 2>/dev/null

# Run Hugo under a restricted user in CI
sudo -u hugo-build hugo --gc --minify