CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Attackers can bypass IP restrictions in Hugo's remote resource fetching by using mixed-case URL schemes, allowing access to internal network services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100693?
CVE-2026-100693 is a high-severity server-side request forgery vulnerability in gohugoio hugo, published on 26 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
Weakness: CWE-178
Which versions are affected by CVE-2026-100693?
It affects 1 product.
Products include Gohugo Hugo.
How do I fix CVE-2026-100693?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-100693 being exploited?
There is no known exploitation of CVE-2026-100693 in the wild and no public exploit code.
Other vulnerabilities in gohugoio hugo
- CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2020-26284 Hugo can execute a binary from the current directory on Windows
- CVE-2026-50135 Hugo: Symlink confinement bypass in resources.Get
Sources
Also known as DEBIAN-CVE-2026-100693, GHSA-pmrv-x7gp-2rjw, GHSA-xpjr-56xg-vx6v, MINI-2c9x-jmgv-chf4, MINI-rwj8-rm4f-f5g5, UBUNTU-CVE-2026-100693.