Skip to content
Threat Feed
Subscribe

Product

Hugo (> 0.123.0, < 0.166.0)

1 brief RSS
high advisory

CVE-2026-100690: Symlink Traversal Vulnerability in Hugo Node.js Integration

Hugo versions 0.161.0 through 0.165.0 contain a directory traversal vulnerability where the Node.js sandbox fails to resolve symbolic links correctly, allowing unauthorized disclosure of sensitive files during the build process.

Hugo +2 vulnerability path-traversal static-site-generator webserver cve-2026-100693
2t 1c