Hugo is a static site generator that retrieves remote content via its resources.GetRemote function. From version 0.91.0 up to but not including 0.162.0 the function enforces the security.http.urls allow‑list on the original request URL but does not re‑check URLs encountered in HTTP 3xx redirects. An allowed server, or one whose DNS or response the attacker controls, could therefore redirect the request to a host that the policy intended to forbid, causing Hugo to fetch from the redirected target. This bypass also removes any host‑shape restriction the operator had configured. The primary impact is that an attacker can obtain arbitrary external content without the user’s consent, potentially exposing secrets or inserting malicious artifacts into the generated site.

The vulnerability affects installations of the gohugoio Hugo static site generator that are version 0.91.0 or newer but lower than 0.162.0. Any site that uses resources.GetRemote to fetch remote assets is impacted. The affected releases span the range 0.91.0 through 0.161.x, while version 0.162.0 and later incorporate the fix.

The CVSS score of 6.3 indicates medium severity. The EPSS score of < 1% signals a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a compromised or malicious domain that is present on the security.http.urls allow‑list, which then issues an HTTP redirect to a host that the policy intends to forbid. If successful, the attacker can cause the site to fetch arbitrary remote data, potentially exposing sensitive information or allowing downstream exploitation within the generated site. This attack requires control over the DNS record or HTTP response of a host on the allow‑list, but no privileged access to the Hugo instance itself.