Skip to content
Threat Feed
Subscribe

Tag

Hugo

2 briefs RSS
high advisory

CVE-2026-100690: Symlink Traversal Vulnerability in Hugo Node.js Integration

Hugo versions 0.161.0 through 0.165.0 contain a directory traversal vulnerability where the Node.js sandbox fails to resolve symbolic links correctly, allowing unauthorized disclosure of sensitive files during the build process.

Hugo +2 vulnerability path-traversal static-site-generator webserver cve-2026-100693
2t 1c
high advisory

Hugo security.http.urls Bypass via Alternate IPv4 Encodings (SSRF)

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo versions 0.162.0 through 0.163.0, where the 'security.http.urls' policy designed to deny requests to loopback, internal, and cloud-metadata IPv4 literals could be bypassed as the policy only matched dotted-decimal notation, allowing alternate IPv4 encodings (integer, hex, octal) to pass, enabling build-time server-side requests to internal services and cloud-metadata endpoints when untrusted or data-derived URLs are passed to 'resources.GetRemote'.

Hugo ssrf vulnerability build-time webserver
2r 3t