{"id":"DEBIAN-CVE-2026-58403","details":"Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile \"somefile\" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.","modified":"2026-09-07T05:00:09.143825618Z","published":"2026-07-06T20:16:38.173Z","upstream":["CVE-2026-58403"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-58403"}],"affected":[{"package":{"name":"hugo","ecosystem":"Debian:13","purl":"pkg:deb/debian/hugo?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1","0.165.0-2","0.165.0-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58403.json"}},{"package":{"name":"hugo","ecosystem":"Debian:14","purl":"pkg:deb/debian/hugo?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.165.0-1"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58403.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}]}