Hugo versions 0.161.0 through 0.165.0 validate only the lexical path of files processed by Node.js tools such as css.PostCSS, css.TailwindCSS, and js.Babel. Because the permission model follows symbolic links without validating that the final target remains inside the allowed project directory, a build that includes a symlink pointing outside the sandbox can read any file that the Hugo build process can access. An attacker who can submit content— for example, via a pull request— can add a symlink like assets/css/x.css that points to /etc/passwd and combine it with a PostCSS plugin that reads the file. This results in disclosure of arbitrary files and allows the attacker to embed their contents into the published site. The core weakness is a path traversal flaw, identified as CWE‑59, and the primary impact is a breach of confidentiality.

Hugo users running any of the vulnerable releases between v0.161.0 and v0.165.0 (inclusive), which execute Node.js tools under their default security configuration. Projects that do not invoke the affected Node.js utilities are not impacted. The vulnerability does not affect earlier or later versions; it is mitigated in v0.166.0 and later, which scan allowed paths and reject any symbolic link that resolves outside them.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is currently unavailable, and CISA has not listed the exploit in its KEV catalog. Nonetheless, the attack requires only the ability to contribute content to a Hugo project—a common privilege in collaborative sites—making it a realistic threat. Once a malicious symlink is incorporated into a build, the compromised Node.js tool will automatically read the target file, enabling an attacker to obtain sensitive data with no additional steps.