Nuclei Path Traversal vulnerability

CVE-2023-37896

Summary

A sandbox bypass vulnerability affected Nuclei users who utilized the tool as a Go code SDK prior to version 2.9.9. The issue, which did not impact CLI users, stemmed from improper sanitization during payload loading in sandbox mode. Specifically, relative paths could evade security checks, posing a risk of unauthorized file access from the filesystem. This significant flaw has been rectified in version 2.9.9, where maintainers have made sandbox mode the default setting for filesystem loading. Users are now presented with new options to manage local file access and network restrictions effectively, enhancing security for those employing custom templates.

References