Medium severity · published Oct 12, 2026
CVE-2026-109574
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hugo · gohugoio
before 0.167.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109574
vendor-advisory
https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf
third-party-advisory
https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback
More from hugo
9.8
CVE-2026-89259
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
8.6
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
8.4
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
8.1
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
7.5
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots