Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the resources.Get function. An attacker can access arbitrary files outside the intended directory by placing a symlink inside a mounted directory that points to files outside the mount. This is only exploitable if the...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resources.GetRemote process when HTTP redirects are not properly validated against the configured allow-list. An attacker can access restricted internal or otherwise forbidden hosts by leveraging...

GHSA-VXGM-5RMG-5W8G Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

Hugo: XSS via text/html content files

Commit: e41a06447d — Disallow HTML content by default Affected versions: all Hugo versions prior to v0.162.0. Fixed in: v0.162.0. Severity: Low to Medium, depending on threat model. Not an issue if you fully trust every file under /content and every content adapter you load. Description. Hugo...

GHSA-C54G-XJWJ-8G82 Hugo: XSS via text/html content files

Commit: e41a06447d — Disallow HTML content by default Affected versions: all Hugo versions prior to v0.162.0. Fixed in: v0.162.0. Severity: Low to Medium, depending on threat model. Not an issue if you fully trust every file under /content and every content adapter you load. Description. Hugo...

[SECURITY] Fedora 43 Update: hugo-0.162.1-1.fc43

The world=E2=80=99s fastest framework for building websites...

[SECURITY] Fedora 44 Update: hugo-0.162.1-1.fc44

The world=E2=80=99s fastest framework for building websites...

PT-2026-50158

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.161.1 Description A regression in the virtual filesystem allows a symlink confinement bypass. The RootMappingFs.statRoot function calls Stat, which follows symlinks, instead of Lstat. This allows a direct lookup...

PT-2026-50156

Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.162.0 Description Hugo accepts content files in various markup formats. Files mapped to the text/html media type, such as .html files located under /content or pages generated by a content adapter where content.mediaTy...

Fedora 43 : hugo (2026-6f3d11bdc6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6f3d11bdc6 advisory. Update to 0.162.1 rhbz2455512 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Fedora 44 : hugo (2026-7fe2bb8a08)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7fe2bb8a08 advisory. Update to 0.162.1 rhbz2455512 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.162.1-1.hum1 aarch64, x8664 hugo-0.162.1-1.hum1.src src...

github.com/gohugoio/hugo: Hugo: Security policy bypass via HTTP redirect manipulation

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, by controlling a server or its DNS, to redirect HTTP requests to a forbidden host. This bypasses the intended security policy, potentially leading to unauthorized access to resources or information disclosur...

github.com/gohugoio/hugo: Hugo: Information disclosure due to symlink confinement bypass

A flaw was found in Hugo, a static site generator. A regression in the resources.Get function caused it to follow symbolic links symlinks, which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, su...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

@11ty/eleventy (=3.0.0-alpha.16), @agiflowai/aicode-toolkit (>=0.6.0 <=1.1.0) +95 more potentially affected by CVE-2026-44646 via liquidjs (>=10.10.0 <=10.25.7)

liquidjs NPM version =10.10.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.8.0, =1.0.1, =1.6.3, =3.11.0, =3.11.0, =3.11.0, =1.0.0, =1.0.0-beta.5 - @clairview/api =23.1.0 and more Source cves: CVE-2026-44646 Source advisory: OSV:GHSA-9X9P-QF8F-MVJG...

Path Traversal

Hugo is vulnerable to Path Traversal. The vulnerability is due to unrestricted execution of Node-based asset pipeline tools such as PostCSS, Babel, and TailwindCSS during site builds, allowing code from untrusted sites to read or write files outside the project's working directory when processed ...

Linux Distros Unpatched Vulnerability : CVE-2026-44301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node- based asset pipelines PostCSS, Babel, TailwindCSS, Hugo...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...