Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the…

Risk score
51/100
CVSS
8.4 v3.1
Exploit chance (30 days)
0.1%
Published
26 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
Affected
Gohugo Hugo before 0.166.0
Fix
Upgrade Gohugo Hugo to 0.166.0 or later.
Exploitation
No known exploitation

Story map

Story map: Gohugo HugoTHE FLAWSTHE FIXCVE-2026-100693Hugo versions from v0.162.0before v0.166.0 contain acase-sensitive validation flaw…CVSS 8.4 · EPSS 0%CVE-2026-100690Information disclosureCVSS 7.5 · EPSS 0%CVE-2026-100692Hugo is a static site generatorCVSS 7.5 · EPSS 0%Upgrade Gohugo Hugo0.166.0or later on your release lineWho is exposedGohugo Hugo before 0.166.0AMBER · PATCH THIS WEEKGohugo HugoHugo versions from v0.161.0through v0.165.0 run Node.jstools (css.PostCSS,css.TailwindCSS, js.Babel) underthe Node.js permission model torestrict file system reads tothe project directory and…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-178 (CWE-178)16 other warnings in 30 days →Same productEarlier Gohugo Hugo warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gohugo Hugo: Amber, patch this week. Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that p…

The flaws

  • CVE-2026-100693: Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the… (CVSS 8.4 · EPSS 0%)
  • CVE-2026-100690: Information disclosure (CVSS 7.5 · EPSS 0%)
  • CVE-2026-100692: Hugo is a static site generator (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Gohugo Hugo: 0.166.0 or later on your release line

Who is exposed: Gohugo Hugo before 0.166.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.4 high

References

Original description

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.

Last activity 26 Sep 2026. Patch Forecast updates every hour.