CVE-2026-50135

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50135", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T18:49:32.275Z", "datePublished": "2026-07-06T19:52:04.561Z", "dateUpdated": "2026-07-07T16:57:29.874Z"}, "containers": {"cna": {"title": "Hugo: Symlink confinement bypass in resources.Get", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw"}, {"name": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a", "tags": ["x_refsource_MISC"], "url": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a"}, {"name": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0"}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"version": ">= 0.123.0, < 0.162.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T19:52:04.561Z"}, "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made \u00a0RootMappingFs.statRoot\u00a0 use \u00a0Stat\u00a0 (follows symlinks) instead of \u00a0Lstat\u00a0, so a direct \u00a0resources.Get\u00a0 of a symlink pointing outside its mount returned the target's contents \u2014 letting a symlink planted in a local mount (e.g. a vendored \u00a0themes/\u00a0 theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0."}], "source": {"advisory": "GHSA-fw87-fv5r-9fpw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T16:52:31.351209Z", "id": "CVE-2026-50135", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T16:57:29.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50135", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T16:52:31.351209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T16:52:35.316Z"}}], "cna": {"title": "Hugo: Symlink confinement bypass in resources.Get", "source": {"advisory": "GHSA-fw87-fv5r-9fpw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": ">= 0.123.0, < 0.162.0"}]}], "references": [{"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw", "name": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a", "name": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0", "name": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made \u00a0RootMappingFs.statRoot\u00a0 use \u00a0Stat\u00a0 (follows symlinks) instead of \u00a0Lstat\u00a0, so a direct \u00a0resources.Get\u00a0 of a symlink pointing outside its mount returned the target's contents \u2014 letting a symlink planted in a local mount (e.g. a vendored \u00a0themes/\u00a0 theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T19:52:04.561Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50135", "state": "PUBLISHED", "dateUpdated": "2026-07-07T16:57:29.874Z", "dateReserved": "2026-06-03T18:49:32.275Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-06T19:52:04.561Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hugo", "vendor": "gohugoio", "versions": [{"status": "affected", "version": ">= 0.123.0, < 0.162.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "matchCriteriaId": "C293B2BB-CA8A-4ECD-9674-943C0196A0A1", "versionEndExcluding": "0.161.1", "versionStartIncluding": "0.123.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made \u00a0RootMappingFs.statRoot\u00a0 use \u00a0Stat\u00a0 (follows symlinks) instead of \u00a0Lstat\u00a0, so a direct \u00a0resources.Get\u00a0 of a symlink pointing outside its mount returned the target's contents \u2014 letting a symlink planted in a local mount (e.g. a vendored \u00a0themes/\u00a0 theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0."}, {"lang": "es", "value": "Hugo es un generador de sitios est\u00e1ticos. Desde la versi\u00f3n 0.123.0 hasta la 0.161.1, una regresi\u00f3n hizo que RootMappingFs.statRoot usara Stat (sigue enlaces simb\u00f3licos) en lugar de Lstat, por lo que un resources.Get directo de un enlace simb\u00f3lico que apuntaba fuera de su punto de montaje devolv\u00eda el contenido del destino - permitiendo que un enlace simb\u00f3lico plantado en un punto de montaje local (por ejemplo, un tema \u2019themes/\u2019 suministrado) leyera archivos arbitrarios accesibles para el usuario de Hugo. Los temas de m\u00f3dulos Go de GitHub (con los enlaces simb\u00f3licos eliminados) y los recorridos de directorios no se vieron afectados. Corregido en la versi\u00f3n 0.162.0."}], "id": "CVE-2026-50135", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50135", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T16:52:31.351209Z", "version": "2.0.3"}}]}, "published": "2026-07-06T21:16:56.347", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.123.0,0.162.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "created": "2026-07-07T05:30:04.446618+00:00", "updated": "2026-08-01T18:30:04.993939+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}