Hugo is a static site generator. Between versions 0.123.0 and 0.161.1 a regression in the RootMappingFs layer caused the statRoot method to use Stat, which follows symlinks, instead of Lstat, which does not. As a result, calling resources.Get on a symlink that points outside its local mount (for example, a symlink in a vendored theme under the themes/ directory) resolves to the target file and returns its contents. This allows the Hugo build process to read arbitrary files that the user running Hugo normally cannot access. Themes obtained through Go modules from GitHub do not contain symlinks, and directory walk functionality is unaffected. The issue was fixed in Hugo 0.162.0.

All installations of Hugo from 0.123.0 through 0.161.1 are vulnerable. The flaw triggers when a local mount—such as a vendored theme under the themes/ directory—contains a symlink that points outside the intended directory. A direct call to resources.Get will resolve that symlink and return the target file’s contents, granting the Hugo build process access to arbitrary files it would normally not see. The issue was fixed in Hugo 0.162.0.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. An EPSS score of < 1% indicates a very low but nonzero exploitation probability, and it is not listed in CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to place a symlink within a local mount, such as a vendored theme under the themes/ directory, that points outside the intended directory tree. Once such a symlink is present, a direct call to resources.Get will expose the target file’s contents to the Hugo build process running as the user.