https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 09:12:26 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-100692 <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-100692 https://vulnerability.circl.lu/vuln/ghsa-m29q-9cm9-wcf6 <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> https://vulnerability.circl.lu/vuln/ghsa-m29q-9cm9-wcf6 https://vulnerability.circl.lu/vuln/rhsa-2026:66266 <p>hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure. github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content</p> <p>hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure. github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape github.com/gohugoio/hugo: Hugo: Stored cross-site scripting via unescaped lineAnchors option github.com/gohugoio/hugo: Hugo: Information disclosure via symlinked mount roots github.com/gohugoio/hugo: Hugo: Security restriction bypass via mixed-case URL schemes github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content</p> https://vulnerability.circl.lu/vuln/rhsa-2026:66266 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-100692 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo&#39;s symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -&gt; /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-100692