{"id":"DEBIAN-CVE-2026-100693","details":"Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.","modified":"2026-09-27T05:00:07.960271461Z","published":"2026-09-26T14:16:54.007Z","upstream":["CVE-2026-100693"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-100693"}],"affected":[{"package":{"name":"hugo","ecosystem":"Debian:12","purl":"pkg:deb/debian/hugo?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.111.3-1","0.112.7-1","0.113.0-1","0.113.0-2","0.113.0-3","0.114.1-1","0.114.1-2","0.115.4-1","0.116.1-1","0.117.0-1","0.118.2-1","0.119.0-1","0.119.0-2","0.120.3-1","0.120.4-1","0.121.1-1","0.121.2-1","0.122.0-1","0.123.3-1","0.123.7-1","0.123.8-1","0.123.8-2","0.124.1-1","0.125.4-1","0.125.5-1","0.125.6-1","0.125.7-1","0.126.1-1","0.126.2-1","0.126.3-1","0.127.0-1","0.128.2-1","0.128.2-2","0.129.0-1","0.129.0-2","0.130.0-1","0.130.0-2","0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1","0.165.0-2","0.165.0-3","0.166.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100693.json"}},{"package":{"name":"hugo","ecosystem":"Debian:13","purl":"pkg:deb/debian/hugo?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1","0.165.0-2","0.165.0-3","0.166.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100693.json"}},{"package":{"name":"hugo","ecosystem":"Debian:14","purl":"pkg:deb/debian/hugo?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.131.0-1","0.131.0-2","0.150.0-1","0.150.1-1","0.151.0-1","0.151.1-1","0.151.2-1","0.152.1-1","0.152.2-1","0.153.0-1","0.153.1-1","0.153.1-2","0.153.1-3","0.153.2-1","0.154.1-1","0.154.2-1","0.154.2-2","0.154.3-1","0.154.5-1","0.155.1-1","0.155.2-1","0.155.3-1","0.157.0-1","0.157.0-2","0.157.0-3","0.158.0-1","0.158.0-2","0.158.0-3","0.159.0-1","0.159.1-1","0.159.2-1","0.160.0-1","0.160.0-2","0.160.1-1","0.161.0-1","0.161.1-1","0.162.1-1","0.162.1-2","0.162.1-3","0.162.1-4","0.162.1-5","0.162.1-6","0.162.1-7","0.165.0-1","0.165.0-2","0.165.0-3","0.166.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100693.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}