Medium severity · published Oct 12, 2026
CVE-2026-109595
Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hugo · gohugoio
0.84.0 before 0.167.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109595
vendor-advisory
https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424
third-party-advisory
https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver
More from hugo
9.8
CVE-2026-89259
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
8.6
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
8.4
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
8.1
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
7.5
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots