Hugo versions after v0.123.0 and before v0.166.0 did not properly enforce symlink confinement beyond the mount root, allowing symlinks in themes/ or vendored modules at mount roots to point outside the intended directory tree. This enabled reading and publishing of files outside local paths during site builds via functions like resources.Get and resources.Match. Modules fetched via Go modules are not affected due to the absence of symlinks in module zips. The issue was fixed in v0.166.0 by treating symlinked mount roots and intermediate symlinked directories as non-existent for all modules. A workaround is to inspect and remove symlinks at mount roots before building or replace them with explicit mounts.

An attacker or malicious theme/module could include symlinks at mount roots to expose files outside the intended local directories during site builds. This could lead to unintended disclosure of files and publishing of unauthorized content to the public directory. The vulnerability does not escalate privileges within the main project if absolute paths are already mounted by configuration. Modules fetched via Go modules are not vulnerable.

A fix is available in Hugo version 0.166.0. Users should upgrade to v0.166.0 or later to fully mitigate this vulnerability. As a temporary workaround, inspect themes/ and vendored modules for symlinks at mount roots before building and remove or replace them with explicit mounts.