PT-2026-50157 · Hugo · Hugo

CVE-2026-50134 · Published 2026-06-16 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hugo versions 0.91.0 through 0.161.1

Description The resources.GetRemote function enforces the security.http.urls policy on the initial URL provided, but it fails to re-validate intermediate URLs during HTTP 3xx redirects. This allows a trusted server, or an attacker controlling its DNS or response, to redirect the request to a forbidden host, such as http://localhost/ or an internal IP address. This bypass also nullifies any host-shape restrictions implemented by the operator.

Recommendations Update to version 0.162.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-50134

GHSA-VXGM-5RMG-5W8G

GO-2026-5681

OPENSUSE-SU-2026:21483-1

RHSA-2026:24577

Affected Products

Hugo

References · 1754

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50134.json · Exploit
• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50 · Patch
• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-50134 · Security Note
• https://osv.dev/vulnerability/GHSA-vxgm-5rmg-5w8g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-50134 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-50134 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-50134 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-50134 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5681 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-50134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50134 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0 · Note
• https://github.com/gohugoio/hugo · Note