CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
An attacker contributing content can use symlinks to read arbitrary files outside the project directory during Hugo builds, potentially disclosing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100690?
CVE-2026-100690 is a high-severity path traversal vulnerability in gohugoio hugo, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.
Weakness: CWE-59
Which versions are affected by CVE-2026-100690?
It affects 1 product.
Products include Gohugo Hugo.
How do I fix CVE-2026-100690?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100690 being exploited?
There is no known exploitation of CVE-2026-100690 in the wild and no public exploit code.
Other vulnerabilities in gohugoio hugo
- CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- CVE-2020-26284 Hugo can execute a binary from the current directory on Windows
- CVE-2026-50135 Hugo: Symlink confinement bypass in resources.Get
Sources
Also known as DEBIAN-CVE-2026-100690, GHSA-gqg5-5gw3-54pq, GHSA-x3mx-cm49-8m9c, MINI-4qc6-2j6r-3x47, MINI-jv48-5x58-jq27, UBUNTU-CVE-2026-100690.