{"id":"EUVD-2026-41907","enisaUuid":"e4f22ac1-b5f0-3282-94a8-3aafb1dcef68","description":"Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo\u0027s virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile \"somefile\" where somefile was a symlink pointing outside the mount would return the target\u0027s contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.","datePublished":"Jul 6, 2026, 7:25:45 PM","dateUpdated":"Jul 6, 2026, 8:51:27 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc\nhttps://github.com/gohugoio/hugo/pull/15020\nhttps://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.1\n","aliases":"CVE-2026-58403\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"5a65a7f3-80db-315d-a705-80d7e668b889","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.123.0, \u003c 0.163.1"}],"enisaIdVendor":[{"id":"5a3fef6d-a3ef-3d3a-a413-225b0bdcfbeb","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"e3218de7-9477-312a-bf1d-713821e97766","vulnerability":{"id":"CVE-2026-58403","description":"Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo\u0027s virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile \"somefile\" where somefile was a symlink pointing outside the mount would return the target\u0027s contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.","datePublished":"Jul 6, 2026, 7:25:45 PM","dateUpdated":"Jul 6, 2026, 8:51:27 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc\nhttps://github.com/gohugoio/hugo/pull/15020\nhttps://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.1\n","enisa_id":"EUVD-2026-41907\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"bcf3f6d8-09bd-3e7f-b3d0-cddbe42d15ca","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.123.0, \u003c 0.163.1"}],"vulnerabilityVendor":[{"id":"78ac90c9-e92f-38d2-9ba5-b2538b7f02a0","vendor":{"name":"gohugoio"}}]}}],"enisaIdAdvisory":[{"id":"6e513b8c-2069-38e2-b080-656acb143681","advisory":{"id":"RHSA-2026:36862","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jul 8, 2026, 8:16:29 PM","dateUpdated":"Sep 8, 2026, 12:06:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36862\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json\n","aliases":"CVE-2026-50133\nCVE-2026-58402\nCVE-2026-58403\nCVE-2026-58404\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"49c3db57-a74d-31eb-9130-2db9e2e58362","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"9ec5bace-2d36-3dd2-9585-a6b6f9d6e72e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a13e8035-a773-3f92-a83d-87720fd9999c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"efdf1028-b694-3d4a-90c4-28adde3fb315","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}}]}}]}