CyberRota Analysis
AI-GeneratedVersions of Hugo from v0.162.0 to v0.166.0 are vulnerable due to a case-sensitive validation flaw in the security.http.urls IP-literal deny rule, allowing attackers to bypass restrictions by using mixed-case URL schemes. This vulnerability enables unauthorized access to restricted IP addresses, such as localhost, potentially leading to data exposure or manipulation. Organizations using affected versions of Hugo should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
Related CVEs
Other vulnerabilities affecting the same vendor(s)