CVE-2026-76804 projectdiscovery CVE debrief

Who should care

Defenders and operators using Nuclei for vulnerability scanning should assess exposure and verify version. They should also restrict untrusted workflow execution, monitor for suspicious activity, and implement proper access controls for workflow execution. Additionally, they should review compensating controls for exposed systems and track exceptions.

Why it matters

CVE-2026-76804 allows local file reading via untrusted Nuclei workflows, impacting CLI users and SDK integrations. Defenders should verify Nuclei version, restrict untrusted workflow execution, and monitor activity.

• Verify Nuclei version to determine exposure
• Restrict execution of untrusted workflows
• Monitor for suspicious workflow activity
• Implement proper access controls for workflow execution

Technical summary

The workflow template loading path in Nuclei does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow, allowing an untrusted unsigned workflow to load a file-protocol template and read local files from the scanner host. This issue arises from Nuclei's failure to properly restrict file-protocol template loading, impacting CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. The vulnerability is fixed in version 3.10.0.

Defensive priority

Defenders should prioritize verifying Nuclei version and restricting untrusted workflow execution.

Recommended defensive actions

• Verify Nuclei version and restrict untrusted workflow execution
• Implement proper access controls for workflow execution
• Monitor for suspicious workflow activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.