CVE-2026-109595: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in gohugoio hugo

CVE-2026-109595 is a path traversal vulnerability in the Hugo static site generator affecting versions >=0.84.0 and <0.167.0. The issue arises from improper limitation of pathnames in ESBuild's fallback resolver used in js.Build, js.Batch, and css.Build functions. Malicious themes or modules can exploit this to read arbitrary files outside the project root by shipping relative imports or symlinks that point outside the project directory. This allows bundling of any file readable by the build user into the published JavaScript or CSS output, potentially exposing sensitive information.

An attacker who can supply malicious themes or modules to a Hugo build process can read arbitrary files outside the project directory that the build user has access to. This can lead to unintended disclosure of sensitive files through the published JavaScript or CSS output. There is no indication of remote code execution or privilege escalation. The vulnerability requires user interaction (UI:A) and local access to supply the malicious content. No known exploits in the wild have been reported.

A fix is available in Hugo version 0.167.0 and later. Users should upgrade to version 0.167.0 or above to remediate this vulnerability. Until then, avoid using untrusted themes or modules that could exploit this path traversal issue. Patch status is confirmed by the affected version range indicating the vulnerability is fixed starting at 0.167.0.