Bug 2531847 (CVE-2026-89258)

Summary:	CVE-2026-89258 hugo: github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anjoseph, eglynn, jjoyce, jprabhak, jpretori, jschluet, lchilton, lhh, mburns, mgarciac, rhel-process-autobot, sfeifer, watson-tool-maintainers, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, who can place a symbolic link (symlink) in a mounted directory, to bypass path confinement. This bypass enables functions performing direct resource lookups to follow the symlink and read files outside the intended project boundaries. The consequence is the disclosure of sensitive file contents within the generated site.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2537825
Bug Blocks:

Description OSIDB Bzimport 2026-09-11 11:33:31 UTC

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.