GHSA-r48v-r4vw-h9v8

A theme or module can ship a _vendor/modules.txt with an import path containing .. segments. Hugo used this path as the module's root directory without checking that it stays inside _vendor, so a malicious theme can make Hugo treat any directory on the build host (up to /) as its module root and read files from it.

collectModulesTXT in modules/collect.go builds the vendored module directory with filepath.Join(vendorDir, path), where path comes straight from _vendor/modules.txt. When an import resolves through the vendor list, Hugo uses that directory as is and skips the checks that normally keep a theme under themesDir. The resulting root is added to Hugo's filesystem overlay, which makes files outside the project available to readFile, resources.Get, os.ReadFile and mounts (e.g. a static mount that publishes the directory).

The fix rejects any modules.txt path that is not local (filepath.IsLocal), so the build fails with an invalid module path error.