Bug 2550056 (CVE-2026-109595)

Summary: CVE-2026-109595 hugo: Hugo: Information disclosure via path traversal during asset compilation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anjoseph, eglynn, jjoyce, jprabhak, jpretori, jschluet, lchilton, lhh, mburns, mgarciac, rhel-process-autobot, sfeifer, watson-tool-maintainers, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Hugo. This vulnerability allows an attacker to cause unauthorized information disclosure through path traversal when processing untrusted themes or modules. By supplying relative file paths or symbolic links that reference locations outside the project directory, an attacker can cause arbitrary files readable by the build user to be incorporated into the published output during asset compilation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2555649, 2555650    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-12 22:51:32 UTC 
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.