CVE-2026-109596

5.5 MEDIUMpublic exploit available

Published 2026-10-12 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses

CWE-59

Public exploit & PoC references

https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47

All references

https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100419PoC
HIGHCVE-2026-100690PoC
HIGHCVE-2026-100692PoC
CRITICALCVE-2026-100715PoC
CRITICALCVE-2026-100716PoC
HIGHCVE-2026-100838PoC
CRITICALCVE-2026-101894PoC
HIGHCVE-2026-102113PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.