A path traversal flaw exists in the css.Sass implementation of Hugo versions before 0.167.0. The Sass compiler’s import fallback incorrectly handles @import and @use paths, allowing an attacker to supply stylesheets that reference files outside the site’s root directory. This leads to the compilation of arbitrary files into the generated CSS and exposes sensitive data that is normally protected by the project's directory boundaries.

The vulnerability affects all deployments of gohugoio Hugo prior to version 0.167.0. Any site that uses third‑party themes or modules that include custom Sass code is at risk.

The CVSS score is 6.7, indicating moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely need to deliver or embed malicious stylesheets through a malicious theme or module; the exploit path is local and relies on the user or automation that compiles the site. The inferred attack vector is a trusted‑user upload or compromised module installation.