CVE-2026-76804

MEDIUM 5.5

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.

CWE	CWE-284
Vendor	projectdiscovery
Product	nuclei
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for projectdiscovery nuclei

Be the first to know when new medium vulnerabilities affecting projectdiscovery nuclei are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

projectdiscovery / nuclei

>= 3.0.0, < 3.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97 github.com: https://github.com/projectdiscovery/nuclei/pull/7489 github.com: https://github.com/projectdiscovery/nuclei/commit/638be4481d27f1bbf90f971bbf6e3023777f2089 github.com: https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0