CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
An attacker can read local files from the scanner host by bypassing file-protocol restrictions in untrusted Nuclei workflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-76804?
CVE-2026-76804 is a medium-severity path traversal vulnerability in projectdiscovery nuclei, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
Weakness: CWE-284
Which versions are affected by CVE-2026-76804?
5 open source packages ship an affected version, including github.com/projectdiscovery/nuclei/v3, github.com/projectdiscovery/nuclei and github.com/projectdiscovery/nuclei/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei Go | All versions | None |
github.com/projectdiscovery/nuclei/v2 Go | All versions | None |
How do I fix CVE-2026-76804?
Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-76804 being exploited?
There is no known exploitation of CVE-2026-76804 in the wild and no public exploit code.
Sources
Also known as GHSA-qgw5-7j4f-fg97, GO-2026-6574.