Hugo versions after v0.123.0 and before v0.165.0 improperly handle symlinks in parent directories during direct resource lookups such as resources.Get and os.ReadFile. This improper link resolution allows an attacker who can place or convince a site author to place a symlink inside a mounted directory to cause these functions to follow the symlink and read files outside the intended project boundaries. This leads to unintended disclosure of file contents in the built site. The vulnerability is a follow-up to previous incomplete fixes and is resolved in Hugo v0.165.0. Themes mounted as Go modules fetched from GitHub are unaffected because symlinks are stripped on download, and multi-directory walks like content/asset walking are not vulnerable.

An attacker capable of placing or influencing the placement of a symlink inside a mounted directory can cause Hugo to disclose arbitrary file contents outside the project boundaries in the generated static site. This can lead to sensitive information leakage. The vulnerability does not require privileges or user interaction and has a critical severity with a CVSS 4.0 score of 9.3.

Upgrade Hugo to version 0.165.0 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the improper link resolution issue. Themes fetched as Go modules from GitHub are not affected due to symlink stripping.