CVE-2026-58403— Hugo symlink confinement bypass in os.ReadFile
Possible ATT&CK Techniques 1AI
T1083 · File and Directory DiscoveryGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58403
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hugo symlink confinement bypass in os.ReadFile
Source: NVD (National Vulnerability Database)
Vulnerability Description
Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: NVD (National Vulnerability Database)
Vulnerability Title
GoHugo Hugo 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
gohugo hugo是gohugo团队开源的一个生成静态网站的框架。 GoHugo Hugo v0.123.0版本至v0.163.0版本存在后置链接漏洞，该漏洞源于文件系统回归导致RootMappingFs.statRoot调用Stat而非Lstat，使得符号链接指向挂载树外文件时可读取任意文件，可能导致任意文件读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58403
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58403
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58403 (2)
Vendor Advisories for CVE-2026-58403 (1)
Vendor Pages for CVE-2026-58403 (1)
- 🔗 Release v0.163.1 · gohugoio/hugo · GitHubx_refsource_MISC
Same Patch Batch · gohugoio · 2026-07-06 · 6 CVEs total
| CVE-2026-58404 | Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings | |
| CVE-2026-58402 | Hugo default code block renderer XSS via unescaped code-fence language | |
| CVE-2026-50134 | Hugo: security.http.urls allow-list bypass via HTTP redirects | |
| CVE-2026-50133 | Hugo: XSS via text/html content files | |
| CVE-2026-50135 | Hugo: Symlink confinement bypass in resources.Get |
IV. Related Vulnerabilities
Same product: hugo
- CVE-2026-50135
Hugo: Symlink confinement bypass in resources.Get - CVE-2026-50134
Hugo: security.http.urls allow-list bypass via HTTP redirect - CVE-2026-50133
Hugo: XSS via text/html content files - CVE-2026-58402
Hugo default code block renderer XSS via unescaped code-fenc - CVE-2026-58404
Hugo security.http.urls deny rules bypassed by alternate IPv
Same vendor: gohugoio
- CVE-2026-50135
Hugo: Symlink confinement bypass in resources.Get - CVE-2026-50134
Hugo: security.http.urls allow-list bypass via HTTP redirect - CVE-2026-50133
Hugo: XSS via text/html content files - CVE-2026-58402
Hugo default code block renderer XSS via unescaped code-fenc - CVE-2026-58404
Hugo security.http.urls deny rules bypassed by alternate IPv
Same weakness: CWE-59
- CVE-2026-15788
WCOW cache mount source selector resolves NTFS junctions out - CVE-2026-8170
ExtremeXOS Privilege Escalation via Symlink Following in Fil - CVE-2026-16130
nearai ironclaw write_file path_utils.rs validate_path link - CVE-2026-16077
AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _norm - CVE-2026-12391
ubuntu-pro-client Local Privilege Escalation and Information
V. Comments for CVE-2026-58403
No comments yet