Advisory · CVE-2026-100692
Hugo symlinked theme mount roots leak files into builds and published sites
Hugo after v0.123.0 and before v0.166.0 stopped symlink confinement checks at the mount root itself, so a theme or vendored module could contain a symlink at a mount root (for example themes/mytheme/assets pointing outside the module). Files behind the symlink were readable during builds via resources.Get and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Fixed in v0.166.0.
- Vendor
- Hugo
- Product
- Hugo
- Identifier / CWE
- CVE-2026-100692
CWE-59 - Action timing
- Immediate
Explain it like I’m five
The rule says every theme's supplies must come from the local pantry. A theme instead bolts a door into the pantry that opens onto the street, and the kitchen happily serves whatever comes through it, even putting it on the menu.
- 01Symlinked mount root
A theme or vendored module contains a symlink at a mount root, such as themes/mytheme/assets pointing outside the module.
- 02Confinement gap
Hugo skips symlink confinement checks at the mount root itself.
- 03Build reads
Files behind the symlink are readable during builds via resources.Get.
- 04Published leak
The same files can be published to public/ via static mounts, bypassing the local-path rule.
What happened
Hugo after v0.123.0 and before v0.166.0 stopped performing symlink confinement checks at the mount root itself (CVE-2026-100692, CVSS 8.7). A theme or vendored module could therefore contain a symlink at a mount root, for example themes/mytheme/assets pointing outside the module. Files behind the symlink were readable during builds via resources.Get and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Fixed in Hugo v0.166.0.
What to do
- Upgrade Hugo to v0.166.0 or later.
- Audit third-party themes and vendored modules for symlinks at mount roots.
- Review published site output for files that should never have left the build machine.
- Prefer themes from trusted sources and pin module versions.
Management note
Themes are third-party code that runs inside your build with your build’s privileges. This flaw is a reminder that theme supply chains deserve the same scrutiny as dependency supply chains.