‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. random_savv · · focus · HN ↗
    I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
    1. vntok · · focus · HN ↗
      Sorry in advance if you were joking, but for readers who aren't in the know: Hugo had, in fact, two 9.3 CVSS vulnerabilities just 11 days ago...

      <a href="https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;CVE-2026-89259" rel="nofollow">https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;CVE-2026-89259

      <a href="https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;CVE-2026-89258" rel="nofollow">https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;CVE-2026-89258

      1. BadBadJellyBean · · focus · HN ↗
        I have full control over the inputs for hugo and the output is pure static HTML. It&#x27;s better if there are no CVEs but I really don&#x27;t sweat these. My Hugo template runs 100% pure CSS and no JS.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.