{
  "cveId": "CVE-2026-109595",
  "url": "https://patchblox.com/security/cve/CVE-2026-109595",
  "summary": "CVE-2026-109595 is fixed in hugo on 1 platform by DEBIAN-CVE-2026-109595 (version 0.167.0-1), released October 13, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "hugo: Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to...",
  "description": "Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild\u0027s fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.",
  "published": "2026-10-12T23:17:22Z",
  "severity": "",
  "epss": 0.00144,
  "epssPercentile": 0.0369,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "hugo",
      "release": "Debian 14",
      "fixedVersion": "0.167.0-1",
      "fix": "DEBIAN-CVE-2026-109595",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-109595",
      "released": "2026-10-13T23:28:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}