File Access Vulnerability in Nuclei Scanner by ProjectDiscovery
CVE-2026-76804

5.5MEDIUM

Key Information:

Vendor

Projectdiscovery
Status
Nuclei
Vendor
CVE Published:
22 September 2026

What is CVE-2026-76804?

Nuclei versions 3.0.0 to 3.10.0 are susceptible to a file access vulnerability, allowing untrusted unsigned workflows to load file-protocol templates. This flaw enables unauthorized access to local files on the scanner host, particularly affecting CLI users and SDK integrations utilizing default file-access restrictions. The vulnerability is addressed in version 3.10.0.

Affected Version(s)

nuclei >= 3.0.0, < 3.10.0

References

https://github.com/projectdiscovery/nuclei/security/advis...
x_refsource_CONFIRM
https://github.com/projectdiscovery/nuclei/pull/7489
x_refsource_MISC
https://github.com/projectdiscovery/nuclei/commit/638be44...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.