CVE-2026-76804: Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nucleito a version that resolves this vulnerability.Fixed in 3.10.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
CLI users who run workflows with -w are affected if they process untrusted unsigned workflows. SDK integrations are also exposed when they accept end-user workflows while relying on the default restriction on file-template access.
What must an attacker provide or convince an operator to do?
An attacker needs an untrusted unsigned workflow to be loaded by the scanner. The workflow can reference a file: protocol template, allowing it to read local files from the scanner host.
Does leaving file templates disabled prevent exploitation?
No. The workflow loading path bypasses the -file capability gate when resolving file: protocol templates referenced by a workflow, so exploitation can occur even when the operator has not enabled file templates.
What versions require remediation?
The issue affects versions from 3.0.0 until 3.10.0 and is fixed in version 3.10.0. Upgrade to 3.10.0, and avoid running untrusted unsigned workflows until the update is applied.