CyberRota Analysis
AI-GeneratedA vulnerability in Hugo versions 0.123.0 to 0.161.1 allows symlinks to be exploited, enabling unauthorized access to arbitrary files accessible to the Hugo user when using the resources.Get function. This issue arises from a regression that caused RootMappingFs.statRoot to utilize Stat instead of Lstat, potentially exposing sensitive data. Users of Hugo, particularly those utilizing symlinked themes or local mounts, should prioritize updating to version 0.162.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)