Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-58403

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.7%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-58403
  • Gohugo » Hugo » Version: 0.123.0
    cpe:2.3:a:gohugo:hugo:0.123.0
  • Gohugo » Hugo » Version: 0.123.1
    cpe:2.3:a:gohugo:hugo:0.123.1
  • Gohugo » Hugo » Version: 0.123.2
    cpe:2.3:a:gohugo:hugo:0.123.2
  • Gohugo » Hugo » Version: 0.123.3
    cpe:2.3:a:gohugo:hugo:0.123.3
  • Gohugo » Hugo » Version: 0.123.4
    cpe:2.3:a:gohugo:hugo:0.123.4
  • Gohugo » Hugo » Version: 0.123.5
    cpe:2.3:a:gohugo:hugo:0.123.5
  • Gohugo » Hugo » Version: 0.123.6
    cpe:2.3:a:gohugo:hugo:0.123.6
  • Gohugo » Hugo » Version: 0.123.7
    cpe:2.3:a:gohugo:hugo:0.123.7
  • Gohugo » Hugo » Version: 0.123.8
    cpe:2.3:a:gohugo:hugo:0.123.8
  • Gohugo » Hugo » Version: 0.124.0
    cpe:2.3:a:gohugo:hugo:0.124.0
  • Gohugo » Hugo » Version: 0.124.1
    cpe:2.3:a:gohugo:hugo:0.124.1
  • Gohugo » Hugo » Version: 0.125.0
    cpe:2.3:a:gohugo:hugo:0.125.0
  • Gohugo » Hugo » Version: 0.125.1
    cpe:2.3:a:gohugo:hugo:0.125.1
  • Gohugo » Hugo » Version: 0.125.2
    cpe:2.3:a:gohugo:hugo:0.125.2
  • Gohugo » Hugo » Version: 0.125.3
    cpe:2.3:a:gohugo:hugo:0.125.3
  • Gohugo » Hugo » Version: 0.125.4
    cpe:2.3:a:gohugo:hugo:0.125.4
  • Gohugo » Hugo » Version: 0.125.5
    cpe:2.3:a:gohugo:hugo:0.125.5
  • Gohugo » Hugo » Version: 0.125.6
    cpe:2.3:a:gohugo:hugo:0.125.6
  • Gohugo » Hugo » Version: 0.125.7
    cpe:2.3:a:gohugo:hugo:0.125.7
  • Gohugo » Hugo » Version: 0.126.0
    cpe:2.3:a:gohugo:hugo:0.126.0
  • Gohugo » Hugo » Version: 0.126.1
    cpe:2.3:a:gohugo:hugo:0.126.1
  • Gohugo » Hugo » Version: 0.126.2
    cpe:2.3:a:gohugo:hugo:0.126.2
  • Gohugo » Hugo » Version: 0.126.3
    cpe:2.3:a:gohugo:hugo:0.126.3
  • Gohugo » Hugo » Version: 0.127.0
    cpe:2.3:a:gohugo:hugo:0.127.0
  • Gohugo » Hugo » Version: 0.128.0
    cpe:2.3:a:gohugo:hugo:0.128.0
  • Gohugo » Hugo » Version: 0.128.1
    cpe:2.3:a:gohugo:hugo:0.128.1
  • Gohugo » Hugo » Version: 0.128.2
    cpe:2.3:a:gohugo:hugo:0.128.2
  • Gohugo » Hugo » Version: 0.129.0
    cpe:2.3:a:gohugo:hugo:0.129.0
  • Gohugo » Hugo » Version: 0.130.0
    cpe:2.3:a:gohugo:hugo:0.130.0
  • Gohugo » Hugo » Version: 0.131.0
    cpe:2.3:a:gohugo:hugo:0.131.0
  • Gohugo » Hugo » Version: 0.132.0
    cpe:2.3:a:gohugo:hugo:0.132.0
  • Gohugo » Hugo » Version: 0.132.1
    cpe:2.3:a:gohugo:hugo:0.132.1
  • Gohugo » Hugo » Version: 0.132.2
    cpe:2.3:a:gohugo:hugo:0.132.2
  • Gohugo » Hugo » Version: 0.133.0
    cpe:2.3:a:gohugo:hugo:0.133.0
  • Gohugo » Hugo » Version: 0.133.1
    cpe:2.3:a:gohugo:hugo:0.133.1
  • Gohugo » Hugo » Version: 0.134.0
    cpe:2.3:a:gohugo:hugo:0.134.0
  • Gohugo » Hugo » Version: 0.134.1
    cpe:2.3:a:gohugo:hugo:0.134.1
  • Gohugo » Hugo » Version: 0.134.2
    cpe:2.3:a:gohugo:hugo:0.134.2
  • Gohugo » Hugo » Version: 0.134.3
    cpe:2.3:a:gohugo:hugo:0.134.3
  • Gohugo » Hugo » Version: 0.135.0
    cpe:2.3:a:gohugo:hugo:0.135.0
  • Gohugo » Hugo » Version: 0.136.0
    cpe:2.3:a:gohugo:hugo:0.136.0
  • Gohugo » Hugo » Version: 0.136.1
    cpe:2.3:a:gohugo:hugo:0.136.1
  • Gohugo » Hugo » Version: 0.136.2
    cpe:2.3:a:gohugo:hugo:0.136.2
  • Gohugo » Hugo » Version: 0.136.3
    cpe:2.3:a:gohugo:hugo:0.136.3
  • Gohugo » Hugo » Version: 0.136.4
    cpe:2.3:a:gohugo:hugo:0.136.4
  • Gohugo » Hugo » Version: 0.136.5
    cpe:2.3:a:gohugo:hugo:0.136.5
  • Gohugo » Hugo » Version: 0.137.0
    cpe:2.3:a:gohugo:hugo:0.137.0
  • Gohugo » Hugo » Version: 0.137.1
    cpe:2.3:a:gohugo:hugo:0.137.1
  • Gohugo » Hugo » Version: 0.138.0
    cpe:2.3:a:gohugo:hugo:0.138.0
  • Gohugo » Hugo » Version: 0.139.0
    cpe:2.3:a:gohugo:hugo:0.139.0
  • Gohugo » Hugo » Version: 0.139.1
    cpe:2.3:a:gohugo:hugo:0.139.1
  • Gohugo » Hugo » Version: 0.139.2
    cpe:2.3:a:gohugo:hugo:0.139.2
  • Gohugo » Hugo » Version: 0.139.3
    cpe:2.3:a:gohugo:hugo:0.139.3
  • Gohugo » Hugo » Version: 0.139.4
    cpe:2.3:a:gohugo:hugo:0.139.4
  • Gohugo » Hugo » Version: 0.139.5
    cpe:2.3:a:gohugo:hugo:0.139.5
  • Gohugo » Hugo » Version: 0.140.0
    cpe:2.3:a:gohugo:hugo:0.140.0
  • Gohugo » Hugo » Version: 0.140.1
    cpe:2.3:a:gohugo:hugo:0.140.1
  • Gohugo » Hugo » Version: 0.140.2
    cpe:2.3:a:gohugo:hugo:0.140.2
  • Gohugo » Hugo » Version: 0.141.0
    cpe:2.3:a:gohugo:hugo:0.141.0
  • Gohugo » Hugo » Version: 0.142.0
    cpe:2.3:a:gohugo:hugo:0.142.0
  • Gohugo » Hugo » Version: 0.143.0
    cpe:2.3:a:gohugo:hugo:0.143.0
  • Gohugo » Hugo » Version: 0.143.1
    cpe:2.3:a:gohugo:hugo:0.143.1
  • Gohugo » Hugo » Version: 0.144.0
    cpe:2.3:a:gohugo:hugo:0.144.0
  • Gohugo » Hugo » Version: 0.144.1
    cpe:2.3:a:gohugo:hugo:0.144.1
  • Gohugo » Hugo » Version: 0.144.2
    cpe:2.3:a:gohugo:hugo:0.144.2
  • Gohugo » Hugo » Version: 0.145.0
    cpe:2.3:a:gohugo:hugo:0.145.0
  • Gohugo » Hugo » Version: 0.146.0
    cpe:2.3:a:gohugo:hugo:0.146.0
  • Gohugo » Hugo » Version: 0.146.1
    cpe:2.3:a:gohugo:hugo:0.146.1
  • Gohugo » Hugo » Version: 0.146.2
    cpe:2.3:a:gohugo:hugo:0.146.2
  • Gohugo » Hugo » Version: 0.146.3
    cpe:2.3:a:gohugo:hugo:0.146.3
  • Gohugo » Hugo » Version: 0.146.4
    cpe:2.3:a:gohugo:hugo:0.146.4
  • Gohugo » Hugo » Version: 0.146.5
    cpe:2.3:a:gohugo:hugo:0.146.5
  • Gohugo » Hugo » Version: 0.146.6
    cpe:2.3:a:gohugo:hugo:0.146.6
  • Gohugo » Hugo » Version: 0.146.7
    cpe:2.3:a:gohugo:hugo:0.146.7
  • Gohugo » Hugo » Version: 0.147.0
    cpe:2.3:a:gohugo:hugo:0.147.0
  • Gohugo » Hugo » Version: 0.147.1
    cpe:2.3:a:gohugo:hugo:0.147.1
  • Gohugo » Hugo » Version: 0.147.2
    cpe:2.3:a:gohugo:hugo:0.147.2
  • Gohugo » Hugo » Version: 0.147.3
    cpe:2.3:a:gohugo:hugo:0.147.3
  • Gohugo » Hugo » Version: 0.147.4
    cpe:2.3:a:gohugo:hugo:0.147.4
  • Gohugo » Hugo » Version: 0.147.5
    cpe:2.3:a:gohugo:hugo:0.147.5
  • Gohugo » Hugo » Version: 0.147.6
    cpe:2.3:a:gohugo:hugo:0.147.6
  • Gohugo » Hugo » Version: 0.147.7
    cpe:2.3:a:gohugo:hugo:0.147.7
  • Gohugo » Hugo » Version: 0.147.8
    cpe:2.3:a:gohugo:hugo:0.147.8
  • Gohugo » Hugo » Version: 0.147.9
    cpe:2.3:a:gohugo:hugo:0.147.9
  • Gohugo » Hugo » Version: 0.148.0
    cpe:2.3:a:gohugo:hugo:0.148.0
  • Gohugo » Hugo » Version: 0.148.1
    cpe:2.3:a:gohugo:hugo:0.148.1
  • Gohugo » Hugo » Version: 0.148.2
    cpe:2.3:a:gohugo:hugo:0.148.2
  • Gohugo » Hugo » Version: 0.149.0
    cpe:2.3:a:gohugo:hugo:0.149.0
  • Gohugo » Hugo » Version: 0.149.1
    cpe:2.3:a:gohugo:hugo:0.149.1
  • Gohugo » Hugo » Version: 0.150.0
    cpe:2.3:a:gohugo:hugo:0.150.0
  • Gohugo » Hugo » Version: 0.150.1
    cpe:2.3:a:gohugo:hugo:0.150.1
  • Gohugo » Hugo » Version: 0.151.0
    cpe:2.3:a:gohugo:hugo:0.151.0
  • Gohugo » Hugo » Version: 0.151.1
    cpe:2.3:a:gohugo:hugo:0.151.1
  • Gohugo » Hugo » Version: 0.151.2
    cpe:2.3:a:gohugo:hugo:0.151.2
  • Gohugo » Hugo » Version: 0.152.0
    cpe:2.3:a:gohugo:hugo:0.152.0
  • Gohugo » Hugo » Version: 0.152.1
    cpe:2.3:a:gohugo:hugo:0.152.1
  • Gohugo » Hugo » Version: 0.152.2
    cpe:2.3:a:gohugo:hugo:0.152.2
  • Gohugo » Hugo » Version: 0.153.0
    cpe:2.3:a:gohugo:hugo:0.153.0
  • Gohugo » Hugo » Version: 0.153.1
    cpe:2.3:a:gohugo:hugo:0.153.1
  • Gohugo » Hugo » Version: 0.153.2
    cpe:2.3:a:gohugo:hugo:0.153.2
  • Gohugo » Hugo » Version: 0.153.3
    cpe:2.3:a:gohugo:hugo:0.153.3
  • Gohugo » Hugo » Version: 0.153.4
    cpe:2.3:a:gohugo:hugo:0.153.4
  • Gohugo » Hugo » Version: 0.153.5
    cpe:2.3:a:gohugo:hugo:0.153.5
  • Gohugo » Hugo » Version: 0.154.0
    cpe:2.3:a:gohugo:hugo:0.154.0
  • Gohugo » Hugo » Version: 0.154.1
    cpe:2.3:a:gohugo:hugo:0.154.1
  • Gohugo » Hugo » Version: 0.154.2
    cpe:2.3:a:gohugo:hugo:0.154.2
  • Gohugo » Hugo » Version: 0.154.3
    cpe:2.3:a:gohugo:hugo:0.154.3
  • Gohugo » Hugo » Version: 0.154.4
    cpe:2.3:a:gohugo:hugo:0.154.4
  • Gohugo » Hugo » Version: 0.154.5
    cpe:2.3:a:gohugo:hugo:0.154.5
  • Gohugo » Hugo » Version: 0.155.0
    cpe:2.3:a:gohugo:hugo:0.155.0
  • Gohugo » Hugo » Version: 0.155.1
    cpe:2.3:a:gohugo:hugo:0.155.1
  • Gohugo » Hugo » Version: 0.155.2
    cpe:2.3:a:gohugo:hugo:0.155.2
  • Gohugo » Hugo » Version: 0.155.3
    cpe:2.3:a:gohugo:hugo:0.155.3
  • Gohugo » Hugo » Version: 0.156.0
    cpe:2.3:a:gohugo:hugo:0.156.0
  • Gohugo » Hugo » Version: 0.157.0
    cpe:2.3:a:gohugo:hugo:0.157.0
  • Gohugo » Hugo » Version: 0.158.0
    cpe:2.3:a:gohugo:hugo:0.158.0
  • Gohugo » Hugo » Version: 0.159.0
    cpe:2.3:a:gohugo:hugo:0.159.0
  • Gohugo » Hugo » Version: 0.159.1
    cpe:2.3:a:gohugo:hugo:0.159.1
  • Gohugo » Hugo » Version: 0.159.2
    cpe:2.3:a:gohugo:hugo:0.159.2
  • Gohugo » Hugo » Version: 0.160.0
    cpe:2.3:a:gohugo:hugo:0.160.0
  • Gohugo » Hugo » Version: 0.160.1
    cpe:2.3:a:gohugo:hugo:0.160.1
  • Gohugo » Hugo » Version: 0.161.0
    cpe:2.3:a:gohugo:hugo:0.161.0
  • Gohugo » Hugo » Version: 0.161.1
    cpe:2.3:a:gohugo:hugo:0.161.1
  • Gohugo » Hugo » Version: 0.162.0
    cpe:2.3:a:gohugo:hugo:0.162.0
  • Gohugo » Hugo » Version: 0.162.1
    cpe:2.3:a:gohugo:hugo:0.162.1
  • Gohugo » Hugo » Version: 0.163.0
    cpe:2.3:a:gohugo:hugo:0.163.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved