Executive brief
Nuclei is a vulnerability scanner used by security teams to identify weaknesses in web applications and infrastructure. The tool restricts execution of "file-protocol" templates (which read local files from the scanner host) unless explicitly enabled. An attacker can bypass this restriction by embedding file-protocol templates in an unsigned workflow file, allowing unauthorized local file reads even when the operator disabled file access. This affects users running workflows from untrusted sources.
Technical details
The vulnerability is a security gate bypass in Nuclei's workflow template loader. The main template loader enforces a `-file` flag requirement for file-protocol templates to prevent unintended local file access, but the workflow loader did not perform the same check when resolving template references. When a workflow (which are unsigned by default) references a file-protocol template, the loader accepts and executes it without verifying that the `-file` flag was enabled. An attacker can craft an untrusted workflow to read arbitrary local files from the scanner host. The fix, released in Nuclei v3.10.0, enforces the `-file` gate consistently across all template loading paths.
Affected products
- ProjectDiscovery Nuclei before 3.10.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix released in Nuclei v3.10.0 via GitHub PR #7489