CVE-2026-109596: Improper Link Resolution Before File Access ('Link Following') in gohugoio hugo

CVE-2026-109596 describes an improper link resolution vulnerability in Hugo versions >=0.162.0 and <0.167.0. The flaw allows malicious themes or modules to exploit nested-mount ancestor directories by placing symlinks or NTFS junctions at virtual ancestor directories. This causes Hugo's resource matching process to list and publish local files outside the intended root directory during builds, potentially exposing sensitive local files.

An attacker controlling a theme or module can cause Hugo to expose local files outside the intended root directory during site builds. This can lead to information disclosure of local files, which may contain sensitive data. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 score is 6.7 (medium severity), reflecting local attack vector with user interaction required and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted themes or modules and review theme sources carefully. Monitor vendor communications for an official fix or update.