CVE-2026-100690
Gohugo Hugo: information disclosure
- Risk score
- 66/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that p…
- Affected
- Gohugo Hugo before 0.166.0
- Fix
- Upgrade Gohugo Hugo to 0.166.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Gohugo Hugo: Amber, patch this week. Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that p…
The flaws
- CVE-2026-100690: Information disclosure (CVSS 7.5 · EPSS 0%)
- CVE-2026-100692: Hugo is a static site generator (CVSS 7.5 · EPSS 0%)
- CVE-2026-100693: Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the… (CVSS 8.4 · EPSS 0%)
The fix
Upgrade Gohugo Hugo: 0.166.0 or later on your release line
Who is exposed: Gohugo Hugo before 0.166.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-59 (CWE-59). 77 other warnings in 30 days
- Same product: Earlier Gohugo Hugo warnings. 2 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: node.js
References
Original description
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.
Last activity 26 Sep 2026. Patch Forecast updates every hour.