CVE-2026-50135 is a CWE-59 (Improper Link Resolution Before File Access) vulnerability in Hugo, a static site generator. Between versions 0.123.0 and 0.161.1, a regression caused the RootMappingFs.statRoot function to use Stat (which follows symlinks) instead of Lstat (which does not). This allowed a direct call to resources.Get on a symlink pointing outside its mount to return the contents of the symlink's target file, potentially exposing arbitrary files accessible to the Hugo user. This vulnerability affects local mounts such as vendored themes but does not affect go-module themes from GitHub or directory walks where symlinks are stripped. The issue was resolved in version 0.162.0.

An attacker able to place a symlink in a local mount directory (e.g., a vendored theme) could cause Hugo to read and expose arbitrary files outside the intended directory scope. This could lead to unauthorized disclosure of sensitive files accessible to the Hugo process user. The vulnerability does not require privileges or user interaction but does require the attacker to have the ability to plant symlinks locally. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality.

Users should upgrade to Hugo version 0.162.0 or later, where the issue is fixed. No other official remediation or temporary fix is indicated. Until upgrading, avoid using untrusted local mounts or vendored themes that could contain malicious symlinks.