CVE-2026-50135: Hugo Symlink Traversal Allows Arbitrary File Read (CVSS 5.5)

Technical summary

The vulnerability exists in Hugo's RootMappingFs.statRoot function between versions 0.123.0 and 0.161.1. A regression introduced in this version range caused the function to call `Stat` instead of `Lstat` when checking file metadata, causing symlink traversal. When a user or build process calls `resources.Get` on a path that resolves to a symlink, the function follows that symlink and returns the contents of the target file rather than treating the symlink as the resource itself. This enables arbitrary file disclosure for any file readable by the Hugo process user. The vulnerability is limited to direct `resources.Get` calls; indirect access through directory walks and module-based themes remain unaffected. The fix in version 0.162.0 restores the use of `Lstat` to prevent symlink following.

Business impact

For static site generators like Hugo used in CI/CD pipelines, this vulnerability can expose sensitive data during the build process. If your Hugo installation is built in an environment with access to secrets (API keys, database credentials, private configuration), a malicious or compromised theme containing a crafted symlink could leak those secrets into generated site artifacts or logs. Organizations using Hugo in automated deployments, especially those pulling third-party themes from untrusted sources or allowing community contributions to theme directories, face elevated risk. However, impact is typically confined to information disclosure—no code execution or site modification occurs.

Affected systems

Hugo versions 0.123.0 through 0.161.1 are vulnerable. Version 0.162.0 and later contain the fix. The vulnerability applies to installations using local theme directories where symlinks could be introduced (e.g., via vendored themes, git submodules, or local development). Remote Go-module-based themes from GitHub are not vulnerable because the module system strips symlinks during download. Windows systems using Hugo are similarly affected, as Windows supports symlinks in NTFS.

Exploitability

Exploitation requires an attacker to place a symlink in a local theme directory accessible to the Hugo build process. This could occur through several paths: (1) a compromised or malicious community theme installed locally, (2) a supply-chain attack on a vendored theme repository, (3) a developer with write access adding a symlink deliberately, or (4) a pull request or contribution that includes a symlink. The attacker must also know or guess the path to a sensitive file readable by the Hugo process user. Once a symlink is in place, a simple `resources.Get` call in a template or configuration will trigger the vulnerability. No special user interaction is required beyond running `hugo build` or similar commands. The CVSS vector (AV:L, AC:L, PR:N, UI:R) reflects that local access is needed (symlink must be on the local filesystem) and user interaction is required (running Hugo), but no special privileges are necessary.

Remediation

Upgrade to Hugo 0.162.0 or later immediately. If immediate upgrade is not feasible, restrict write access to theme directories to trusted developers only, avoid using untrusted or unvetted community themes locally, and audit existing theme directories for suspicious symlinks using tools like `find -type l`. Additionally, run Hugo builds in isolated CI/CD environments with minimal access to sensitive files and secrets; use secret management systems rather than storing credentials on the filesystem.

Patch guidance

Update Hugo to version 0.162.0 or later. This is a straightforward version bump with no breaking changes; existing Hugo projects should continue to work without modification. Verify the update using `hugo version` after installation. For users managing Hugo via package managers (Homebrew, apt, snap), check for available updates and apply them. For Docker-based deployments, update the base image or Hugo binary reference to 0.162.0 or newer. Test the update in a staging environment before deploying to production builds if your site has complex theme or template logic.

Detection guidance

Review theme directories (typically `themes/` in your Hugo project root) for symlinks using `find themes/ -type l`. Check Git history and recent commits for additions of symlink files to theme directories. In CI/CD logs, look for unexpected file read operations or warnings during the `hugo build` step. If you suspect exposure, examine generated site artifacts and build logs for unexpected file contents. Monitor for any secrets (API keys, tokens) appearing in public site output or logs.

Why prioritize this

This is a medium-severity vulnerability with a clear attack vector for projects using local themes. While it requires local filesystem access and does not enable code execution, the potential for credential or configuration disclosure makes it a priority for any Hugo user in a collaborative or automated build environment. Projects using only remote Go-module themes have no exposure. The existence of a public fix in 0.162.0 makes patching straightforward.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the confluence of: high confidentiality impact (arbitrary file read), no integrity or availability impact, local attack vector (symlink must exist on the filesystem), low attack complexity, no privilege requirement, and required user interaction (running Hugo). The score appropriately balances the real risk of secret disclosure against the requirement for an attacker to plant a symlink in advance, which is a meaningful practical barrier in well-managed projects.

Frequently asked questions