VendorsGohugohugoany version
Vulnerabilities

Gohugo Hugo any version

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

16CVEs
CVE-2026-75926
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
Published 2026-08-18 · Analyzed
9.3EPSS 0.003
CVE-2026-100692
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Published 2026-09-26 · Analyzed
8.7EPSS 0.004
CVE-2026-100690
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
Published 2026-09-26 · Analyzed
8.7EPSS 0.004
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
Published 2026-09-26 · Analyzed
8.6EPSS 0.001
CVE-2020-26284
Hugo can execute a binary from the current directory on Windows
Published 2020-12-21 · Modified
8.5EPSS 0.015
CVE-2026-44301
Hugo: Node tool execution allows file system access outside the project directory
Published 2026-05-12 · Analyzed
8.1EPSS 0.003
CVE-2026-50135
Hugo: Symlink confinement bypass in resources.Get
Published 2026-07-06 · Analyzed
6.9EPSS 0.004
CVE-2026-58404
Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
Published 2026-07-06 · Analyzed
6.8EPSS 0.004
CVE-2026-58403
Hugo symlink confinement bypass in os.ReadFile
Published 2026-07-06 · Analyzed
6.5EPSS 0.005
CVE-2026-50134
Hugo: security.http.urls allow-list bypass via HTTP redirects
Published 2026-07-06 · Analyzed
6.3EPSS 0.004
CVE-2026-50133
Hugo: XSS via text/html content files
Published 2026-07-06 · Analyzed
6.1EPSS 0.003
CVE-2026-100694
Hugo before 0.166.0 Cross-Site Scripting via text/org
Published 2026-09-26 · Analyzed
6.1EPSS 0.002
CVE-2026-10618
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Published 2026-08-24 · Analyzed
5.4EPSS 0.003
CVE-2026-58402
Hugo default code block renderer XSS via unescaped code-fence language
Published 2026-07-06 · Analyzed
5.4EPSS 0.003
CVE-2026-35166
Hugo does not properly escape some Markdown links
Published 2026-04-06 · Analyzed
5.4EPSS 0.002
CVE-2026-100691
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
Published 2026-09-26 · Analyzed
5.4EPSS 0.002