Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Hugo, Symlink Confinement Bypass, #CVE-2026-50135 (Medium) -DC-Jun2026-486 https://dailycve.com/hugo-symlink-confinement-bypass-cve-2026-50135-medium-dc-jun2026-486/
Post summary
A medium‑severity CVE (CVE‑2026‑50135) for Hugo’s symlink confinement bypass has been announced, but no PoC, exploit code, mitigation, or evidence of active exploitation is presented.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gohugo | hugo | - | - | - |