CVE-2026-89258

Hugo (static site generator) versions after v0.123.0 and before v0.165.0 are vulnerable to a symlink confinement bypass via direct resource lookups such as resources.Get and os.ReadFile. Symlinks in parent directories were not dropped during these lookups, allowing an attacker who can place a sym...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...