{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-06T19:52:04Z",
  "bugzilla" : {
    "description" : "github.com/gohugoio/hugo: Hugo: Information disclosure due to symlink confinement bypass",
    "id" : "2497518",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497518"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-59",
  "details" : [ "Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored  themes/  theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.", "A flaw was found in Hugo, a static site generator. A regression in the `resources.Get` function caused it to follow symbolic links (symlinks), which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, such as a vendored theme, to read arbitrary files on the system that are accessible to the user running Hugo. This could lead to unauthorized information disclosure." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-08T00:00:00Z",
    "advisory" : "RHSA-2026:24577",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "hugo-main-0.162.1-1.hum1",
    "impact" : "moderate"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-50135\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50135\nhttps://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a\nhttps://github.com/gohugoio/hugo/releases/tag/v0.162.0\nhttps://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw" ],
  "name" : "CVE-2026-50135",
  "csaw" : false
}