CVE-2026-109574

medium

Description

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.

References

https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback

https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98157

Details

Source: Mitre, NVD

Published: 2026-10-12

Updated: 2026-10-12

Risk Information

CVSS v2

Base Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.7

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00144