CVE-2026-109595: falha de média gravidade em gohugoio hugo
Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.7epss 0.1%
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
gohugoio · hugoCVEs relacionadas — gohugoio hugo
No mesmo produto, das mais perigosas para as menos.
CVE-2020-26284HIGHHugo can execute a binary from the current directory on WindowsEPSS 1.5%CVE-2024-55601MEDIUMHugo does not escape some attributes in internal templatesEPSS 0.6%CVE-2026-89259CRITICALHugo before v0.165.0 Insufficient Permission Restriction via TailwindCSSEPSS 0.6%CVE-2024-32875MEDIUMHugo doesn't escape markdown title in internal render hooksEPSS 0.5%CVE-2026-58403MEDIUMHugo symlink confinement bypass in os.ReadFileEPSS 0.5%CVE-2026-89258CRITICALHugo before v0.165.0 Symlink Confinement Bypass via resources.GetEPSS 0.5%