Hugo: Symlink confinement bypass in resources.Get

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50135 · Microsoft / collected KEV context

EUVD-2026-41922

GHSA-fw87-fv5r-9fpw

GO-2026-5380

cve-program · CVE-2026-50135

• https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw
• https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

euvd · EUVD-2026-41922

• https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw
• https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

nvd · CVE-2026-50135

• https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0
• https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw

osv · GHSA-fw87-fv5r-9fpw

• https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw
• https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
• https://github.com/gohugoio/hugo
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

osv · GO-2026-5380

• https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw
• https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

No related operational record is retained in the current change model.