{"id":"EUVD-2026-41922","enisaUuid":"90f6d784-27d0-33f8-851f-8a17910195d2","description":"Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target\u0027s contents — letting a symlink planted in a local mount (e.g. a vendored  themes/  theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:52:04 PM","dateUpdated":"Jul 7, 2026, 4:57:29 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw\nhttps://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","aliases":"CVE-2026-50135\nGHSA-fw87-fv5r-9fpw\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"c2479321-1ea0-34b7-8bb3-c49eba149d42","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.123.0, \u003c 0.162.0"}],"enisaIdVendor":[{"id":"46a3cf03-46f2-34c5-890d-17c2da344168","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"d1383e04-8b8c-3ea7-be4d-274d6b66d745","vulnerability":{"id":"CVE-2026-50135","description":"Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target\u0027s contents — letting a symlink planted in a local mount (e.g. a vendored  themes/  theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.","datePublished":"Jul 6, 2026, 7:52:04 PM","dateUpdated":"Jul 7, 2026, 4:57:29 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw\nhttps://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41922\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 5, 2026, 7:15:46 AM","vulnerabilityProduct":[{"id":"6fdf8185-88a3-3464-ba6b-2ce57bfd7b88","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"0.123.0, \u003c 0.162.0"}],"vulnerabilityVendor":[{"id":"88df56fc-77ef-34f4-90d9-4653e9bc38fb","vendor":{"name":"gohugoio"}}]}},{"id":"f574b49c-c73c-3b85-8176-f3a66a71a229","vulnerability":{"id":"GHSA-fw87-fv5r-9fpw","description":"Hugo: Symlink confinement bypass in resources.Get","datePublished":"Jun 16, 2026, 8:12:34 PM","dateUpdated":"Jun 16, 2026, 8:12:34 PM","baseScore":0.0,"references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw\nhttps://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a\nhttps://github.com/gohugoio/hugo\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\n","enisa_id":"EUVD-2026-41922\n","aliases":"CVE-2026-50135\nGHSA-fw87-fv5r-9fpw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"a123d4f9-8dfc-322d-bbec-a776021dd6a1","advisory":{"id":"RHSA-2026:24577","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jun 8, 2026, 6:18:50 PM","dateUpdated":"Oct 30, 2026, 7:36:13 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:24577\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24577.json\n","aliases":"CVE-2026-45287\nCVE-2026-50134\nCVE-2026-50135\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0931aeae-2e13-317d-971d-e49198aeb63a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"64ce0dd3-b1f2-3205-95c1-42904967279d","product":{"name":"hugo-0:0.162.1-1.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"97e89ad1-5f5a-3b68-a66e-43ed2ee3d247","product":{"name":"hugo-0:0.162.1-1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"ab72298a-f17d-30a3-b862-a24bd81d5d30","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"be8681b3-2fba-31cd-964d-579cc6257c1c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"bf0f5c9c-68db-3ed5-8c94-d79fe27a7285","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c5ba543b-0458-3a03-847c-376e33280e0d","product":{"name":"hugo-0:0.162.1-1.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}}]}