CVE-2026-100692

Executive Summary

CVE-2026-100692 is a symlink confinement bypass in Hugo, the Go-based static site generator, affecting versions after v0.123.0 and before v0.166.0. The flaw allows a malicious theme or vendored module checked into themes/ to place a symlink at a mount root pointing outside the project, exposing arbitrary host files to site build functions (resources.Get, resources.Match) and allowing those files to be published via static mounts. Because themes and modules are frequently pulled from third-party repositories, the vulnerability is effectively a supply-chain/file-disclosure issue with a High confidentiality impact (CVSS 7.5) and no authentication or user interaction requirement.

Technical Analysis

Hugo implements "mounts" that map module or theme source directories into the project namespace. Prior to v0.123.0 the confinement logic apparently prevented mount sources from being non-local paths. From v0.123.0 through v0.165.x, the symlink confinement check terminated at the mount root itself: it validated that the configured mount source was a local path, but did not verify that the resolved path of the mount root (or directories between the mount root and the module directory) was free of symlinks. Consequently, a theme or module committed into themes/ (or a vendored module) could contain a symlink at a mount root — the NVD example is themes/mytheme/assets -> /some/dir/outside.

During a build, Hugo resolves the mount and follows the symlink. Two consequences follow. First, file-content functions such as resources.Get and resources.Match (and similar resource lookups) can read files located behind the symlink, i.e. outside the project and outside any intended trust boundary. Second, if the symlinked directory is also wired into a static mount, those external files can be emitted into public/, making the disclosure persistent and remotely retrievable if the generated site is served.

The description explicitly rules out two adjacent scenarios to prevent overstating impact:

• Modules fetched via Go modules are not affected, because Go module zip archives cannot represent symlinks.
• This is not a privilege escalation for the main project itself, which may already mount absolute paths by explicit configuration.

The fix in v0.166.0 treats symlinked mount roots — and symlinked directories between the mount root and the module directory — as non-existent for all modules. The CWE mapping is CWE-59 (Improper Link Resolution Before File Access, "Link Following"), consistent with the mechanism described.

No public PoC, exploit code, or Nuclei template exists per the supplied data; there is no evidence of exploitation in the wild and no CISA KEV listing. The attack chain described below is inferred from the vulnerability class, not from an observed exploit.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker identifies a Hugo project (v0.123.0–v0.165.x) that consumes third-party themes or vendored modules from a repository, fork, or archive the attacker can influence. Target identification does not require access to the build host; it requires only the ability to contribute to (or replace) a theme/module source that the victim's build will include.

2. Triggering the flaw. The attacker introduces a symlink at a mount root within the theme or vendored module directory — the NVD example is themes/mytheme/assets -> /some/dir/outside. Because Hugo's confinement check stopped at the mount root, the symlink is resolved rather than rejected during the next build. (Content delivered through Go module zips cannot carry symlinks, so this path is excluded.)

3. Payload / execution method (vulnerability-class level). No code execution is required. The symlink causes Hugo's resource lookups to follow the link; documented example functions are resources.Get and resources.Match, which read the file content behind the symlink. Where the symlinked directory is mapped by a static mount, the content is written into public/ during the build. There is no public PoC; the chain above is derived from the vulnerability class (link following within mount confinement).

4. Post-exploitation impact. The direct consequence is unauthorized read of files reachable through the symlink target (confidentiality impact: High per CVSS 3.1). If the built site is published, the disclosed content becomes retrievable by anyone who can reach public/. No integrity or availability impact is described. Scope is unchanged, as the vulnerability is confined to the module/theme mount handling within the same build context.

Impact Assessment

This is an unauthenticated, network-reachable vulnerability with user interaction none and attack complexity low (AV:N/AC:L/PR:N/UI:N), yielding a base score of 7.5. The sole high metric is Confidentiality (C:H); Integrity and Availability are None, and Scope is Unchanged. Business impact centers on exposure of files readable by the built Hugo process that reside behind a symlinked mount root. The realistic blast radius spans:

• CI/CD build pipelines that fetch or accept third-party themes/vendored modules, where build servers may hold credentials, source trees, or configuration accessible on the filesystem.
• Organizations that publish Hugo-generated sites (documentation portals, marketing sites, internal KBs) and where static mounts can push disclosed files to public/.
• Projects that vendor themes by copying them in without auditing for symlinks.

Because the malicious element lives in a theme/module rather than in the main project tree, standard review focusing on application code can miss it. Affected-version data supplied by the source is empty and OSV packaging is N/A; scope should therefore be determined by Hugo version (v0.123.0 exclusive through v0.166.0 exclusive) rather than by a fixed package list.

Detection Guidance

Sigma Rule

title: Hugo Build Following Symlink at Theme or Module Mount Root (CVE-2026-100692)
id: 9f1d3a52-6c1e-4b7e-9a2c-hugo-100692
status: experimental
description: Detects a Hugo site build process resolving symlinks located beneath themes/ or vendored module directories.
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/hugo'
  selection_symlink:
    CommandLine|contains:
      - 'readlink -f'
      - 'find themes -type l'
      - 'find . -xtype l'
  condition: selection_proc and selection_symlink
falsepositives:
  - Legitimate administrative audits of a theme directory
level: medium
tags:
  - attack.t1195.001
  - cve.2026-100692

Note: Hugo does not emit a dedicated event when following a symlink, so detection focuses on the reconnaissance/build-hygiene behaviors that accompany or expose the condition. Deploy alongside file-integrity monitoring for symlink creation inside themes/.

YARA Rule

rule CVE_2026_100692_Hugo_Theme_Symlink_Mount
{
    meta:
        description = "Detects symlink artifacts pointing outside a Hugo theme or module mount root (CVE-2026-100692)"
        author = "Threat Intelligence"
        reference = "CVE-2026-100692"
        date = "2026-01-01"
    strings:
        $symlink_marker = "themes/" ascii wide
        $assets = "assets" ascii wide
        $outside = "../" ascii wide
        $single_slash = "/some/dir/outside" ascii wide
    condition:
        filesize < 1MB and
        (uint16(0) == 0x0A21 or uint16(0) == 0x0A6C) and
        $symlink_marker and $assets and ($outside or $single_slash)
}

This rule matches symlink target strings (rather than regular file content) recorded in repository metadata or extracted archives where a link path contains themes/, an assets component, and an escaping path segment.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100692 Hugo symlink-mount file disclosure indicator"; flow:established,to_client; http.uri; content:"/"; pcre:"/\.(env|key|pem|ssh|conf|yml|yaml|toml)$/i"; classtype:attempted-recon; reference:cve,2026-100692; sid:2026100692; rev:1;)

This rule targets the retrieval of sensitive files from a published Hugo public/ directory. It is a heuristic companion control: the vulnerability itself is exploited at build time, so this rule is only useful when disclosed files are served from the generated site.

Elastic Detection

process where event.type == "start" and
  process.name == "hugo" and
  process.args : ("*themes/*" or "*modules/*" or "*--source*")

Extend this rule with endpoint file events to catch link creation under themes/:

file where event.action in ("creation", "rename") and
  file.path : "*/themes/*" and
  file.type == "symlink"

Splunk SPL Query

index=main (process_name="hugo" OR Image="*/hugo")
| where match(CommandLine, "(?i)themes/|modules/|resources\.Get|resources\.Match")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmds by host, user
| where count > 0
| sort - last_seen

For file telemetry, search FIM/auditd events for symlink creation under themes/:

index=auditd (type=SYSCALL action=symlink OR syscall=symlink)
| where match(path, "themes/")
| table _time host path comm

Wazuh OSSEC Rule

<group name="hugo,cve-2026-100692,">
  <rule id="100692" level="7">
    <if_sid>550</if_sid>
    <field name="file">themes/</field>
    <match>symlink</match>
    <description>CVE-2026-100692: symlink created under Hugo themes/ directory - possible mount confinement bypass</description>
    <mitre>
      <id>T1195.001</id>
    </mitre>
  </rule>
  <rule id="100693" level="10">
    <if_group>audit</if_group>
    <match>resources.Get</match>
    <match>themes/</match>
    <description>CVE-2026-100692: Hugo build accessing resources behind theme mount root</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Before any build, inspect themes/ and vendored module directories for symlinks at mount roots and between the mount root and module directory. Per the advisory, replace such symlinks with explicit mounts.
   • Restrict build-time access to sensitive host paths: run Hugo builds in isolated containers or low-privilege service accounts that cannot read secrets, credential stores, or unrelated source trees reachable behind a symlink target.
   • Treat third-party themes and vendored modules as untrusted input; pin and review them in code review, and reject contributions that introduce symlinks.
   • Avoid publishing public/ from untrusted builds until symlink hygiene has been verified; publish only from a clean validated build.

2. Patch / upgrade steps

   • Upgrade Hugo to v0.166.0 or later, where symlinked mount roots and intermediate symlinked directories are treated as non-existent for all modules (the described fix).
   • After upgrading, rebuild and diff the generated public/ output against the previous build to confirm no previously disclosed files remain published.

3. Long-term hardening

   • Enforce a supply-chain policy that forbids symlinks in theme/module sources (pre-commit hooks, repository linting).
   • Use SBOM/provenance tracking for themes and vendored modules, and monitor vendor advisories for Hugo.
   • Keep CI runners ephemeral and least-privileged; segregate secrets so filesystem disclosure cannot yield credentials.
   • Note that Go-module-fetched modules are not affected (module zips cannot contain symlinks), so prefer that acquisition path where feasible.

References

• NVD — CVE-2026-100692: https://nvd.nist.gov/vuln/detail/CVE-2026-100692
• Hugo project repository and release notes (v0.166.0 fix): https://github.com/gohugoio/hugo/releases
• CWE-59 — Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• CISA Known Exploited Vulnerabilities catalog (not listed; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1195.001 — Supply Chain Compromise: Compromise Software Dependencies and Development Tools: https://attack.mitre.org/techniques/T1195/001/

No exploit code, public PoC, or threat-actor campaign is associated with this CVE in the supplied intelligence data, and it does not appear in CISA KEV.