A case‑sensitive validation flaw in Hugo’s security.http.urls IP‑literal deny rule allows attackers to bypass restrictions that normally prevent access to internal IP addresses. The flaw arises when a mixed‑case URL scheme is supplied to resources.GetRemote calls; the engine treats the scheme as valid and fetches data from addresses such as localhost, which are intended to be blocked. This flaw can lead to unauthorized retrieval of internal resources, potentially exposing configuration files or other sensitive data. The weakness is classified as CWE‑178 and CWE‑918.

The gohugoio project’s Hugo static‑site generator is affected for all releases from v0.162.0 up to, but not including, v0.166.0. Systems that run any of these versions and use resources.GetRemote or similar functions to fetch remote content are at risk. The issue originates in the IP‑literal deny rule implementation within the security.http.urls configuration.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is < 1% (approximately 0.13%), and the issue is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. Based on the description, it is inferred that the attack can be performed remotely by an attacker who can supply a mixed‑case scheme; local privileges on the target are not required. The attack vector is likely external, through HTTP requests to a Hugo instance that processes remote resources. The flaw permits immediate bypass of internal IP restrictions, so the risk of exploitation remains significant for exposed deployments.