CVE-2026-100692

The static site generator Hugo is vulnerable in versions after v0.123.0 and before v0.166.0 due to insufficient symlink confinement checks. A malicious theme or vendored module located in themes/ could contain a symlink at a mount root (e.g., themes/mytheme/assets -> /some/dir/outside). This a...