Hugo, the static site generator from gohugoio, contains a path traversal flaw in versions starting with 0.84.0 and continuing until (but not including) 0.167.0. An attacker who can supply or influence a malicious theme or module can include relative imports or symbolic links that point outside the project root. When the build process invokes js.Build, js.Batch, or css.Build, ESBuild’s fallback resolver reads these files and bundles their contents into the generated JavaScript or CSS, thereby exposing any file readable by the build user.

The affected product is Hugo, distributed by gohugoio. Any installation whose version identifier is greater than or equal to 0.84.0 and less than 0.167.0 is vulnerable.

The CVSS score of 6.7 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker’s malicious theme or module be processed during a Hugo build; this can occur via compromised repositories, internal developers, or untrusted package sources. If successful, the attacker can read files beyond the intended project directory, increasing the risk of sensitive data disclosure.