CVE-2026-100693

Name
CVE-2026-100693
Description
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/gohugoio/hugo/security/advisories/GHSA-pmrv-x7gp-2rjw
disclosure@vulncheck.com https://www.vulncheck.com/advisories/hugo-0.162.0-before-0.166.0-ip-literal-deny-rule-bypass

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:* hugo >= 0.162.0 < 0.166.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
hugo edge-community 0.164.0-r0 Thomas Boerger <thomas@webhippie.de> possibly vulnerable