Hugo is a static site generator. From version 0.123.0 to 0.161.1, a regression caused RootMappingFs.statRoot to call Stat instead of Lstat, so a direct resources.Get of a symlink pointing outside its mount returned the target's contents—letting a symlink planted in a local mount (e.g., a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0. The vulnerability is a local file read (CWE-59).

All installations of Hugo from 0.123.0 through 0.161.1 are vulnerable. The flaw triggers when a local mount—such as a vendored theme under the themes/ directory—contains a symlink that points outside the intended directory. A direct call to resources.Get will resolve that symlink and return the target file’s contents, granting the Hugo build process access to arbitrary files it would normally not see. The issue was fixed in Hugo 0.162.0 and later releases.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. An EPSS score of < 1% indicates a very low but nonzero exploitation probability, and it is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to place a symlink within a local mount, such as a vendored theme under the themes/ directory, that points outside the intended directory tree. Once such a symlink is present, a direct call to resources.Get will expose the target file’s contents to the Hugo build process running as the user.