CVE-2026-109574: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in gohugoio hugo

Hugo versions prior to 0.167.0 contain a path traversal vulnerability in the css.Sass component. The flaw allows attackers to craft stylesheets with relative, absolute, or symlinked @import or @use targets that bypass directory restrictions, enabling reading of arbitrary files outside the project root directory. These files can then be compiled into the site's CSS, potentially exposing sensitive information.

An attacker who can supply or modify themes or modules can exploit this vulnerability to read arbitrary files on the system where Hugo is run, outside the intended project directory. This could lead to disclosure of sensitive data embedded into the generated CSS files. There is no indication of remote code execution or privilege escalation from the provided data.

Upgrade Hugo to version 0.167.0 or later, where this path traversal vulnerability has been fixed. No other mitigation steps are indicated or required according to the available information.