{"id":"CVE-2026-50135","revision":"0119ada898294f8a868029b2b3bc6c7e","records":[{"revision":"0119ada898294f8a868029b2b3bc6c7e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50135","aliases":[],"title":"Hugo: Symlink confinement bypass in resources.Get","description":"Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made \u00A0RootMappingFs.statRoot\u00A0 use \u00A0Stat\u00A0 (follows symlinks) instead of \u00A0Lstat\u00A0, so a direct \u00A0resources.Get\u00A0 of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored \u00A0themes/\u00A0 theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.","state":0,"publishedAt":"2026-07-06T19:52:04.561+00:00","modifiedAt":"2026-07-07T16:57:29.874+00:00","affected":[{"ecosystem":"Vendor product","name":"hugo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gohugoio\",\n                    \"product\": \"hugo\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.123.0, < 0.162.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw","https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a","https://github.com/gohugoio/hugo/releases/tag/v0.162.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50135","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50135","identifiers":["CVE-2026-50135"]},"retained":false,"historicalAffected":[]}],"coverage":[]}