CVE-2026-76804
MediumCVSS 5.5Summary
In Nuclei from 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates.
Risk Assessment
CLI users running workflows with -w and SDK integrations accepting end-user workflows may expose the scanner host to arbitrary local file reads. This can lead to disclosure of sensitive data from the scanner system.
Recommendation
Upgrade Nuclei to version 3.10.0 or later. Until then, do not run untrusted workflows and restrict SDK integrations that accept external templates.
Other vulnerabilities in Nuclei
See all- CVE-2026-76805Medium
In Nuclei from 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal extractor to be reinterpreted as template syntax. When -env-vars is enabled, a malicious scan target can return marker-shaped content that discloses scanner-host environment variables such as credentials, API keys, or tokens.
- CVE-2026-76803Medium
In Nuclei from 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled.
- CVE-2026-76802Medium
In Nuclei from 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature.
- CVE-2026-92718High
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Original NVD description (English source)
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.