DEBIAN-CVE-2026-109596
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-109596
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109596.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-109596
- Upstream
- Published
- 2026-10-12T23:17:23Z
- Modified
- 2026-10-16T18:00:09Z
- Severity
-
- 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
- References
Affected packages
Debian:14 / hugo
Package
- Name
- hugo
- Purl
- pkg:deb/debian/hugo?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.167.0-1
Affected versions
0.*
0.131.0-1
0.131.0-2
0.150.0-1
0.150.1-1
0.151.0-1
0.151.1-1
0.151.2-1
0.152.1-1
0.152.2-1
0.153.0-1
0.153.1-1
0.153.1-2
0.153.1-3
0.153.2-1
0.154.1-1
0.154.2-1
0.154.2-2
0.154.3-1
0.154.5-1
0.155.1-1
0.155.2-1
0.155.3-1
0.157.0-1
0.157.0-2
0.157.0-3
0.158.0-1
0.158.0-2
0.158.0-3
0.159.0-1
0.159.1-1
0.159.2-1
0.160.0-1
0.160.0-2
0.160.1-1
0.161.0-1
0.161.1-1
0.162.1-1
0.162.1-2
0.162.1-3
0.162.1-4
0.162.1-5
0.162.1-6
0.162.1-7
0.165.0-1
0.165.0-2
0.165.0-3
0.166.0-1
0.166.0-2