Description (CNA)
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| gohugoio / hugo | affected 0.162.0 before 0.167.0; unaffected 0.167.0 |
CWE
CWE-59
References
- https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
- https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor
ADP enrichment
No English description supplied.
No references supplied.