CVE-2026-50135 is a CWE-59 (Improper Link Resolution Before File Access) vulnerability in Hugo, a static site generator. Between versions 0.123.0 and 0.161.1, a regression caused the function RootMappingFs.statRoot to use Stat (which follows symbolic links) instead of Lstat (which does not). This allowed a direct call to resources.Get on a symlink pointing outside its mount to return the target file's contents, potentially exposing arbitrary files accessible to the Hugo user. The vulnerability does not affect go-module themes from GitHub (which strip symlinks) or directory walks. The issue was resolved in version 0.162.0.

An attacker able to plant a symlink in a local mount (such as a vendored themes directory) could cause Hugo to read and expose the contents of arbitrary files outside the intended directory. This could lead to unauthorized disclosure of sensitive information accessible to the Hugo process user. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

Upgrade Hugo to version 0.162.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Users should avoid using affected versions in production environments until patched.