CVE-2026-76803
Received Received - Intake

Arbitrary File Read via MySQL LOAD DATA LOCAL in Nuclei

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-76803
EUVD
EUVD-2026-84553

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
projectdiscovery nuclei From 3.0.0 (inc) to 3.10.0 (inc)
nuclei nuclei From 3.0.0 (inc) to 3.10.0 (inc)
nuclei mysql From 3.0.0 (inc) to 3.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Nuclei's MySQL JavaScript library (versions 3.0.0 to 3.9.9) allows bypassing the local-file sandbox restriction. When a JavaScript template uses the allowAllFiles MySQL DSN option, it can force the scanner to read arbitrary local files via the LOAD DATA LOCAL INFILE command, even when the -allow-local-file-access flag is disabled. The issue occurs because the library does not enforce sandboxing for this specific DSN parameter.

Detection Guidance

This vulnerability affects Nuclei versions 3.0.0 to 3.9.9. To detect it, check your Nuclei version with: nuclei -version. If the version is between 3.0.0 and 3.9.9, the system is vulnerable. Additionally, inspect JavaScript templates for MySQL DSN configurations using allowAllFiles parameter.

Impact Analysis

If you use Nuclei versions 3.0.0 to 3.9.9 with untrusted JavaScript templates or scan attacker-controlled MySQL endpoints, an attacker could read sensitive files on your system. This includes files accessible to the Nuclei process, potentially exposing credentials, configuration files, or other confidential data. The impact is limited to file read access and requires interaction with a malicious MySQL server.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access may result in data breaches, triggering regulatory reporting obligations and potential fines. The confidentiality impact (CVSS 5.3) highlights the risk to regulated data.

Mitigation Strategies

Upgrade Nuclei to version 3.10.0 or later immediately. Avoid running untrusted JavaScript templates against untrusted MySQL endpoints. Disable the allowAllFiles parameter in MySQL DSN configurations if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart