Skip to content
OpenAdvisories
Medium RHSA-2026:36862 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 29, 2026 · Updated Sep 8, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hugo 0:0.163.3-0.1.hum1

Vulnerabilities 4

  • Medium 5.9
    CVE-2026-58403

    Hugo symlink confinement bypass in os.ReadFile

    Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instea…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Medium 5.1
    CVE-2026-50133

    Hugo: XSS via text/html content files

    Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Medium 5.1
    CVE-2026-58402

    Hugo default code block renderer XSS via unescaped code-fence language

    Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Medium 4.6
    CVE-2026-58404

    Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

    Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings…

    gohugoio hugo hugo hugo Debian Ubuntu Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-58402
  • report
    https://access.redhat.com/security/cve/CVE-2026-58403
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-50133
  • report
    https://access.redhat.com/security/cve/CVE-2026-58404
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497463
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-50133
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-50133
  • article
    https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1
  • article
    https://github.com/gohugoio/hugo/releases/tag/v0.162.0
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497467
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58402
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58402
  • article
    https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d
  • article
    https://github.com/gohugoio/hugo/pull/15051
  • article
    https://github.com/gohugoio/hugo/releases/tag/v0.163.3
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497460
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58403
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58403
  • article
    https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229
  • article
    https://github.com/gohugoio/hugo/pull/15020
  • article
    https://github.com/gohugoio/hugo/releases/tag/v0.163.1
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497450
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58404
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58404
  • article
    https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv