Hugo is a static site generator that retrieves remote content through its resources.GetRemote function. In releases from 0.91.0 up to (but not including) 0.162.0 the function applied the security.http.urls allow‑list to the original request URL, but it did not re‑evaluate URLs that were encountered in HTTP 3xx redirects. As a result, a host that was explicitly allowed could redirect the request to a completely different server that the policy intended to forbid, allowing the application to fetch data from an unintended source. This bypass also removes any host‑shape restrictions the operator may have configured. The primary impact is that an attacker can retrieve arbitrary external content without the user’s consent, potentially exposing secrets or injecting malicious artifacts into the generated site.

The vulnerability affects installations of the gohugoio Hugo static site generator that are version 0.91.0 or newer but lower than 0.162.0. Any site that uses resources.GetRemote to fetch remote assets is impacted. The affected releases span the range 0.91.0 through 0.161.x, while version 0.162.0 and later incorporate the fix.

The CVSS score of 6.3 indicates medium severity. The EPSS score of < 1% signals a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a compromised or malicious domain that is present on the security.http.urls allow‑list, which then issues an HTTP redirect to a host that the policy intends to forbid. If successful, the attacker can cause the site to fetch arbitrary remote data, potentially exposing sensitive information or allowing downstream exploitation within the generated site. This attack requires control over the DNS record or HTTP response of a host on the allow‑list, but no privileged access to the Hugo instance itself.