CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory
Attackers can read or write files outside the project directory by exploiting Node-based asset pipelines in Hugo when building untrusted sites.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44301?
CVE-2026-44301 is a medium-severity path traversal vulnerability in gohugoio hugo, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-44301?
3 open source packages ship an affected version, including github.com/gohugoio/hugo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gohugoio/hugo Go | All versions | 0.161.0 |
github.com/gohugoio/hugo Go | From 0.43.0 | 0.161.0 |
github.com/gohugoio/hugo Go | From 0.43.0 | 0.161.0 |
Products include Gohugo Hugo.
How do I fix CVE-2026-44301?
Upgrade github.com/gohugoio/hugo to 0.161.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44301 being exploited?
There is no known exploitation of CVE-2026-44301 in the wild and no public exploit code.
Other vulnerabilities in gohugoio hugo
- CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
- CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
- CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
- CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
- CVE-2020-26284 Hugo can execute a binary from the current directory on Windows
Sources
Also known as DEBIAN-CVE-2026-44301, GHSA-x597-9fr4-5857, GO-2026-5740, JLSEC-2026-793, UBUNTU-CVE-2026-44301.