CVE-2026-92718
Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
| CWE | CWE-347 |
| Vendor | projectdiscovery |
| Product | nuclei |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for projectdiscovery nuclei
Be the first to know when new high vulnerabilities affecting projectdiscovery nuclei are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
projectdiscovery / nuclei
3.7.0 < 3.11.1
References
github.com: https://github.com/projectdiscovery/nuclei/issues/7663 github.com: https://github.com/projectdiscovery/nuclei github.com: https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624 github.com: https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84 github.com: https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76 vulncheck.com: https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache
Credits
🔍 George Chen