https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:29:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-58403 <p><strong>Affected:</strong> gohugoio hugo</p> <p>Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo&#39;s virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile &#34;somefile&#34; where somefile was a symlink pointing outside the mount would return the target&#39;s contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.</p> <p><strong>Affected:</strong> gohugoio hugo</p> <p>Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo&#39;s virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile &#34;somefile&#34; where somefile was a symlink pointing outside the mount would return the target&#39;s contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-58403