CVE-2026-109596

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109596", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-12T20:59:18.909Z", "datePublished": "2026-10-12T22:21:51.306Z", "dateUpdated": "2026-10-14T12:07:23.109Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:51.306Z"}, "datePublic": "2026-09-28T00:00:00.000Z", "title": "Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor", "descriptions": [{"lang": "en", "value": "Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Link Resolution Before File Access ('Link Following')", "cweId": "CWE-59", "type": "CWE"}]}], "affected": [{"vendor": "gohugoio", "product": "hugo", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/gohugoio/hugo", "versions": [{"version": "0.162.0", "status": "affected", "versionType": "semver", "lessThan": "0.167.0"}, {"version": "0.167.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.162.0", "versionEndExcluding": "0.167.0"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.7, "baseSeverity": "MEDIUM"}, "format": "CVSS"}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM"}, "format": "CVSS"}], "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-6c8w-mpp8-9w47)"}, {"name": "VulnCheck Advisory: Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"}], "credits": [{"lang": "en", "value": "White0xdi3", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T12:04:35.108374Z", "id": "CVE-2026-109596", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T12:07:23.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109596", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T12:04:35.108374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T12:06:11.115Z"}}], "cna": {"title": "Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor", "credits": [{"lang": "en", "type": "finder", "value": "White0xdi3"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": "0.162.0", "lessThan": "0.167.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.167.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/gohugoio/hugo", "defaultStatus": "unaffected"}], "datePublic": "2026-09-28T00:00:00.000Z", "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47", "name": "GitHub Security Advisory (GHSA-6c8w-mpp8-9w47)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor", "name": "VulnCheck Advisory: Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.167.0", "versionStartIncluding": "0.162.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T22:21:51.306Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109596", "state": "PUBLISHED", "dateUpdated": "2026-10-14T12:07:23.109Z", "dateReserved": "2026-10-12T20:59:18.909Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-12T22:21:51.306Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/gohugoio/hugo", "product": "hugo", "vendor": "gohugoio", "versions": [{"lessThan": "0.167.0", "status": "affected", "version": "0.162.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.167.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds."}], "id": "CVE-2026-109596", "lastModified": "2026-10-16T19:15:07.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109596", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T12:04:35.108374Z", "version": "2.0.3"}}]}, "published": "2026-10-12T23:17:23.033", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hugo: Hugo: Information disclosure via improper link resolution in nested mounts", "id": "2550016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550016"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-59", "details": ["Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.", "A flaw was found in Hugo. An improper link resolution vulnerability allows an attacker who controls a malicious theme or module to disclose sensitive files outside the intended project root. By placing a symbolic link (a pointer referencing another file location) or filesystem junction within a virtual ancestor directory, an attacker can cause Hugo to read and publish local host files during the site build process."], "mitigation": {"lang": "en:us", "value": "Avoid compiling Hugo sites with untrusted themes or modules. When processing unverified third-party themes, execute Hugo builds within an isolated, unprivileged container environment with minimal directory mounts."}, "name": "CVE-2026-109596", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hugo", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Fix deferred", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-12T22:21:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109596\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109596\nhttps://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47\nhttps://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"], "statement": "A flaw was found in Hugo's virtual filesystem and link resolution logic. When compiling sites that incorporate themes or modules with nested mounts, Hugo fails to properly restrict symbolic links or filesystem junctions within virtual ancestor directories. An attacker who supplies a malicious theme can exploit resources.Match to traverse directory boundaries and publish arbitrary local host files outside the project root during site compilation, bounded by the permissions of the executing user or build container.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.162.0,0.167.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.167.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "created": "2026-10-13T00:00:16.562184+00:00", "updated": "2026-10-13T03:00:09.948151+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}