CVE-2026-76804

Awaiting Analysis Awaiting Analysis - Queue

Workflow Template File Access Bypass in Nuclei

Publication date: 2026-09-22

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-28

Generated

2026-10-13

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-12

NVD

CVE-2026-76804

EUVD

EUVD-2026-84554

Affected Vendors & Products

Vendor	Product	Version / Range
projectdiscovery	nuclei	From 3.0.0 (inc) to 3.10.0 (exc)
projectdiscovery	nuclei	3.10.0
projectdiscovery	nuclei	From 3.0.0 (inc) to 3.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuclei allows file: protocol templates to execute without requiring the -file flag, bypassing a security gate that prevents local file reads on the scanner host. It affects versions 3.0.0 to 3.9.0 and allows untrusted workflows to read local files from the scanner host even when file templates are not enabled.

Detection Guidance

To detect this vulnerability, check if you are running Nuclei versions between 3.0.0 and 3.9.0. Run the command 'nuclei -version' to verify your Nuclei version. If the version is within the affected range, the system is vulnerable.

Impact Analysis

An attacker could craft a malicious workflow that reads sensitive files from your system when you run Nuclei with the -w flag. This could expose confidential data, system files, or other sensitive information stored on the host machine running the scanner.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Nuclei to version 3.10.0 or later immediately. Avoid running workflows from unverified or untrusted sources until the upgrade is complete. This prevents potential local file reads via malicious file-protocol templates.

Hi! I’m here to help you understand CVE-2026-76804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70