Live › vulnerability › CVE-2026-76804
Go to dashboardNuclei versions 3.0.0 through 3.10.0 skip the -file capability check when a workflow loads file: protocol templates. An attacker who supplies an untrusted unsigned workflow can read local files from the machine running the scanner, even when file templates are disabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/projectdiscovery/nuclei | go | all versions | – |
| github.com/projectdiscovery/nuclei/v2 | go | all versions | – |
| github.com/projectdiscovery/nuclei/v3 | go | >= 3.0.0, < 3.10.0 | 3.10.0 |
3.0.0 and < 3.10.0, the module is affected3.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-76804")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.