CVE-2026-92718: Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nucleito a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs local access with sufficient privileges to replace a previously verified template and restore its original file modification time. Exploitation also requires a user to run Nuclei with the modified template.
Are default Nuclei installations affected?
The issue affects Nuclei versions from 3.7.0 before 3.11.1 when template signature verification results are cached. The provided information does not establish whether every default installation uses affected signed templates or cache behavior.
What is the impact if exploitation succeeds?
A modified unsigned template can bypass signature checks and execute arbitrary operating system commands in the context of the user running Nuclei. This can compromise confidentiality, integrity, and availability of that execution environment.
How can I determine whether an environment may be vulnerable?
Check whether Nuclei is version 3.7.0 through 3.11.0 and whether users run templates that could be modified by another local user or process. A suspicious template whose content has changed while its modification time matches a previously verified version is relevant to this bypass.