{"id":"EUVD-2026-41916","enisaUuid":"b1d7c6c7-5d82-3077-aff9-f9ac718f1cd0","description":"Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:42:49 PM","dateUpdated":"Jul 7, 2026, 4:57:36 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g\nhttps://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","aliases":"CVE-2026-50134\nGHSA-vxgm-5rmg-5w8g\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"4943b77e-3670-354d-9468-0ef0c0f7c423","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.91.0, \u003c 0.162.0"}],"enisaIdVendor":[{"id":"f75d2f8b-3c44-38f3-9c67-ee814fc2f237","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"9c0b939e-894c-3854-8ef4-80c911a90f05","vulnerability":{"id":"GHSA-vxgm-5rmg-5w8g","description":"Hugo: security.http.urls allow-list bypass via HTTP redirects","datePublished":"Jun 16, 2026, 7:22:37 PM","dateUpdated":"Jun 16, 2026, 7:22:37 PM","baseScore":0.0,"references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g\nhttps://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50\nhttps://github.com/gohugoio/hugo\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41916\n","aliases":"GHSA-vxgm-5rmg-5w8g\nCVE-2026-50134\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a19f799f-a915-38b5-946e-ab3f99d0e632","vulnerability":{"id":"CVE-2026-50134","description":"Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:42:49 PM","dateUpdated":"Jul 7, 2026, 4:57:36 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g\nhttps://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41916\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 1, 2026, 7:16:18 AM","vulnerabilityProduct":[{"id":"de7a57d0-c6f2-30bb-aac6-3774fc11432a","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.91.0, \u003c 0.162.0"}],"vulnerabilityVendor":[{"id":"cbe39355-1ceb-371e-b2f9-92addeba83e7","vendor":{"name":"gohugoio"}}]}}],"enisaIdAdvisory":[{"id":"b37409fe-f0dc-3571-9674-ce80834f95dd","advisory":{"id":"RHSA-2026:24577","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jun 8, 2026, 6:18:50 PM","dateUpdated":"Oct 30, 2026, 7:36:13 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:24577\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24577.json\n","aliases":"CVE-2026-45287\nCVE-2026-50134\nCVE-2026-50135\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0931aeae-2e13-317d-971d-e49198aeb63a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"64ce0dd3-b1f2-3205-95c1-42904967279d","product":{"name":"hugo-0:0.162.1-1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"97e89ad1-5f5a-3b68-a66e-43ed2ee3d247","product":{"name":"hugo-0:0.162.1-1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"ab72298a-f17d-30a3-b862-a24bd81d5d30","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"be8681b3-2fba-31cd-964d-579cc6257c1c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"bf0f5c9c-68db-3ed5-8c94-d79fe27a7285","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c5ba543b-0458-3a03-847c-376e33280e0d","product":{"name":"hugo-0:0.162.1-1.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}}]}