CVE-2026-89258

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

• CWE-59

• https://github.com/gohugoio/hugo/security/advisories/GHSA-vrv5-r5rf-6v4j
• https://www.vulncheck.com/advisories/hugo-before-0.165.0-symlink-confinement-bypass-via-resources-get

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89252AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5
• CVE-2026-89253WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…8.7
• CVE-2026-89254AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89255AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89256AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89257AVideo through 29.0 contains an insecure direct object refer…5.4
• CVE-2026-89259Hugo is a static site generator. From v0.161.0, Hugo execute…9.8
• CVE-2026-8926When asking curl to use a `.netrc` file to find credentials …9.1
• CVE-2026-89260MoguBlog through 6.2 contains an XML external entity injecti…7.5
• CVE-2026-89261MoguBlog through 6.2 exposes Elasticsearch index management …6.5
• CVE-2026-89262MoguBlog through 6.2 contains an authorization bypass vulner…7.5
• CVE-2026-89263MoguBlog through 6.2 fails to authenticate requests to the /…5.3