The vulnerability arises from Hugo’s symlink checks stopping at the mount root, allowing a symlink within themes/ or a vendored module to point to any path on the host system. When a site build processes such a symlink through resources.Get or similar functions, files located outside the intended project directory become readable and can be published to public/ via static mounts. This flaw permits disclosure of arbitrary files present on the build machine and does not affect Go modules, which cannot contain symlinks.

Versions of Hugo published after v0.123.0 and before v0.166.0 are affected. The issue manifests when a theme or module directory under themes/ contains a symlink at the mount root—for example, themes/mytheme/assets pointing to /some/dir/outside. The vulnerability is not triggered by Go-modules because their zip archives cannot contain symlinks. The problem is limited to builds that use the resources.* API to process such directories.

The CVSS score of 8.7 indicates a high severity risk, though the EPSS score is not available, so the exact likelihood of exploitation remains unclear. The flaw is not listed in the CISA KEV catalog, meaning no publicly known exploits are yet recorded. Attacks would likely occur in environments where an attacker can influence theme or module contents during a build, such as in a continuous‑integration pipeline or a shared build server. The main consequence is unauthorized reading of files from the build host, potentially exposing sensitive data.