CVE-2026-89258: Hugo Static Site Generator Path Traversal

CVE-2026-89258 Overview

Hugo, a widely used static site generator written in Go, contains a symlink handling flaw that allows path confinement to be bypassed during direct resource lookups. The vulnerability affects versions after v0.123.0 and before v0.165.0. An attacker who can place a symlink inside a mounted directory, or who convinces a site author to do so, can cause functions such as resources.Get and os.ReadFile to follow that symlink. The result is disclosure of files outside the intended project boundaries, with their contents embedded in the built site. The issue is tracked as [CWE-59] (Improper Link Resolution Before File Access) and is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw.

Critical Impact
Attackers can exfiltrate arbitrary files readable by the Hugo build process, including secrets, SSH keys, and configuration files, by planting a symlink in a mounted theme or asset directory.

Affected Products

Hugo static site generator versions after v0.123.0
Hugo static site generator versions before v0.165.0
Projects using locally vendored themes or mounted directories containing untrusted symlinks

Discovery Timeline

2026-09-11 - CVE-2026-89258 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89258

Vulnerability Analysis

Hugo enforces path confinement to keep resource resolution within mounted project directories. Prior fixes addressed symlink handling in multi-directory walks such as content and asset traversal. This follow-up flaw shows that direct resource lookups did not drop symlinks located in parent directories of the requested path. Functions including resources.Get and os.ReadFile therefore followed those links to targets outside the project boundary. Any file readable by the user running hugo can be pulled into the generated site output and published to the public web.

Root Cause

The root cause is incomplete symlink stripping in direct-lookup code paths. Hugo checked target paths against mounted directory boundaries but did not evaluate symlinks encountered in intermediate parent directories. When a parent path component resolved to a link pointing outside the project root, the lookup followed the link and returned the external content. This behavior contradicts the confinement guarantees applied to walked directory trees.

Attack Vector

Exploitation requires an attacker to place a symlink inside a mounted directory. The most realistic delivery vector is a malicious or tampered theme vendored locally under themes/. A site author who clones or copies a compromised theme, or accepts a pull request adding a symlink, enables the disclosure at the next build. Themes fetched as Go modules from GitHub are not affected, because GitHub strips symlinks during module download. Multi-directory walks such as content and asset walking are also not affected. Contents of arbitrary readable files, for example /etc/passwd, private keys, or .env files, are then rendered into the published static site. See the GitHub Security Advisory and VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-89258

Indicators of Compromise

Unexpected symbolic links inside themes/, assets/, static/, or other mounted directories referenced in config.toml or hugo.toml.
Built site output containing contents of system files such as /etc/passwd, SSH private keys, or environment secrets.
Recent commits to theme repositories that introduce symlinks, especially links whose targets are relative paths escaping the theme root.

Detection Strategies

Scan project trees for symlinks with find . -type l -exec ls -l {} \; and validate that each target resolves inside the project boundary.
Run hugo version across build hosts and CI runners to flag any instance between v0.123.0 and v0.164.x inclusive.
Inspect generated public/ output for content that does not correspond to any authored source file, particularly binary or credential-shaped strings.

Monitoring Recommendations

Alert on newly added symlinks in source control for repositories that build with Hugo.
Monitor CI/CD build logs for resources.Get calls resolving to unexpected paths.
Track Hugo version drift across development, staging, and production build environments.

How to Mitigate CVE-2026-89258

Immediate Actions Required

Upgrade Hugo to v0.165.0 or later on every workstation, CI runner, and build server.
Audit all locally vendored themes and mounted directories for symlinks and remove any that escape their parent directory.
Rotate any credentials, tokens, or private keys that may have been exposed if a compromised theme was previously built and published.

Patch Information

The vulnerability is fixed in Hugo v0.165.0. The release drops symlinks located in parent directories during direct resource lookups, aligning behavior with the existing walk-based confinement. Refer to the GitHub Security Advisory GHSA-vrv5-r5rf-6v4j for release notes and remediation guidance.

Workarounds

Consume themes exclusively as Go modules fetched from GitHub, which strips symlinks on download.
Restrict write access to project directories and enforce code review on any commit that adds a symbolic link.
Run Hugo builds in a sandboxed environment with a read-only file system outside the project root to limit disclosure scope.

bash

# Upgrade Hugo and verify version
go install github.com/gohugoio/hugo@v0.165.0
hugo version

# Audit project for symlinks before building
find . -type l -not -path './.git/*' -exec ls -l {} \;