Threats tagged 'ghsa-m29q-9cm9-wcf6'

CVE-2026-100692 is a high-severity vulnerability in the Hugo static site generator affecting versions before 0.166.0. It involves improper link resolution before file access, allowing symlinks at mount roots in themes or vendored modules to expose files outside intended directories during site builds. This could lead to unauthorized reading and publishing of files outside the local theme or module paths. The issue is fixed in version 0.166.0 by treating symlinked mount roots and intermediate symlinked directories as non-existent. Modules fetched via Go modules are not affected due to their inability to contain symlinks. Users should inspect and remove symlinks in themes and vendored modules or upgrade to the fixed version.