Bug 2550056 (CVE-2026-109595) - CVE-2026-109595 hugo: Hugo: Information disclosure via path traversal during asset compilation
Summary: CVE-2026-109595 hugo: Hugo: Information disclosure via path traversal during ...
Keywords:
Status: NEW
Alias: CVE-2026-109595
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2555649 2555650
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-12 22:51 UTC by OSIDB Bzimport
Modified: 2026-10-19 15:18 UTC (History)
14 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-12 22:51:32 UTC 
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.
Note You need to log in before you can comment on or make changes to this bug.