Advisory · CVE-2026-100693
Hugo URL scheme case trick bypasses the IP deny list in GetRemote
Hugo v0.162.0 before v0.166.0 has a case-sensitive validation flaw in the security.http.urls IP-literal deny rule: mixed-case URL schemes in resources.GetRemote calls bypass the restriction, letting a build fetch from restricted IP addresses like localhost. Fixed in v0.166.0.
- Vendor
- Hugo
- Product
- Hugo
- Identifier / CWE
- CVE-2026-100693
CWE-178 - Action timing
- Immediate
Explain it like I’m five
The gate blocks a list of forbidden addresses, but it compares letter-for-letter and the visitor writes the street name in mixed case. The gate waves them through to a street it was told to block.
- 01Mixed-case scheme
A template calls resources.GetRemote with a mixed-case URL scheme targeting a denied IP literal.
- 02Case-sensitive check
The security.http.urls IP-literal deny rule compares case-sensitively and finds no match.
- 03Bypass
The restriction is skipped for the mixed-case URL.
- 04Restricted fetch
The build fetches from a restricted IP address such as localhost.
What happened
Hugo v0.162.0 before v0.166.0 has a case-sensitive validation flaw in the security.http.urls IP-literal deny rule (CVE-2026-100693, CVSS 8.6). Mixed-case URL schemes in resources.GetRemote calls bypass the restriction, letting a build fetch from restricted IP addresses such as localhost. Fixed in Hugo v0.166.0.
What to do
- Upgrade Hugo to v0.166.0 or later.
- Audit templates for resources.GetRemote calls, especially in third-party themes, with unusual scheme casing.
- Keep the IP-literal deny configuration tight; the fix makes the check case-insensitive, but defense in depth still applies.
Management note
Case-sensitivity bugs in security checks are the cockroaches of input validation: small, hard to spot, and they show up in pairs. Hugo shipped three advisories the same day; this is the smallest, but it patches in the same upgrade.