Hugo symlink confinement bypass in os.ReadFile

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-58403 · Microsoft / collected KEV context

EUVD-2026-41907

GHSA-c3wq-j5vh-68rc

GO-2026-5309

cve-program · CVE-2026-58403

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1

euvd · EUVD-2026-41907

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1

nvd · CVE-2026-58403

• https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1
• https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc

osv · GHSA-c3wq-j5vh-68rc

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc
• https://github.com/gohugoio/hugo

osv · GO-2026-5309

• https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1

No related operational record is retained in the current change model.