From version 0.123.0 through 0.163.0, Hugo’s virtual filesystem was designed so that files within a mount could not access files outside that mount treeRoot function to call, which follows symbolic links, instead of Lstat. This allowed a call to os.ReadFile on a symlink that pointed to a file outside the mount to return the target file’s contents. The result is that a user running Hugo could read any file reachable by the build process, including configuration files or credentials. The flaw is a link‑traversal vulnerability identified as CWE‑59.

The vulnerability affects the Hugo static site generator released by gohugoio. All official releases from 0.123.0 up to and including 0.163.0 are vulnerable. The issue was fixed in release v0.163.1, which is available as the latest stable version.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1% points to a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable only when an attacker can place a malicious symlink within a theme or content directory before invoking Hugo; the attack requires local file placement and occurs during the build process. If an attacker can supply such a symlink, they can read arbitrary files that the Hugo build process can access.