Hugo versions 0.162.0 through 0.163.0 have a SSRF vulnerability due to incomplete enforcement of the security.http.urls policy. The deny rule blocks loopback, internal, and cloud-metadata IPv4 literals only when expressed in dotted-decimal notation. Alternate IPv4 encodings such as integer, hexadecimal, or octal representations bypass this check. When a template passes an untrusted or data-derived URL to resources.GetRemote, and the host platform uses the cgo system resolver, these alternate encodings resolve to blocked addresses, allowing SSRF to internal services including cloud-metadata endpoints during build time. Redirects also reuse this flawed check, extending the vulnerability to redirect hops. The vulnerability is addressed in Hugo version 0.163.1.

An attacker controlling template input can cause Hugo to make unauthorized server-side requests to internal network services, including sensitive cloud-metadata endpoints, potentially exposing internal data or enabling further attacks. The vulnerability affects build-time operations and requires the host platform to use the cgo system resolver. The CVSS 4.6 score indicates a medium severity impact with network attack vector, low attack complexity, and partial privileges required.

A fix is available in Hugo version 0.163.1. Users should upgrade to version 0.163.1 or later to remediate this SSRF vulnerability. No official temporary workaround or alternative mitigation is provided in the advisory. Patch status is not explicitly stated beyond the fix in 0.163.1, so users should consult the vendor advisory for the latest remediation guidance.