Is CVE-2026-76804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76804 being exploited in the wild.

How severe is CVE-2026-76804?

Medium severity, with a CVSS score of 5.5, published 22 September 2026.

Which products and versions are affected?

github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.

Is there a fix for CVE-2026-76804?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76804 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76804?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76804: ProjectDiscovery Nuclei security gate bypass via workflow file-protocol templates

Q: Is there a fix for CVE-2026-76804?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76804 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-76804?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76804 · Severity: medium · CVSS 5.5 · Published 2026-09-22

Nuclei is a vulnerability scanner used by security teams to identify weaknesses in web applications and infrastructure. The tool restricts execution of "file-protocol" templates (which read local files from the scanner host) unless explicitly enabled. An attacker can bypass this restriction by embedding file-protocol templates in an unsigned workflow file, allowing unauthorized local file reads even when the operator disabled file access. This affects users running workflows from untrusted sources.

Technologies: github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go), ProjectDiscovery Nuclei. Vendors: Go, ProjectDiscovery.

Quick answers

Is CVE-2026-76804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76804 being exploited in the wild.
How severe is CVE-2026-76804?: Medium severity, with a CVSS score of 5.5, published 22 September 2026.
Which products and versions are affected?: github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.
Is there a fix for CVE-2026-76804?: Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76804 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76804?: Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later
```
go get github.com/projectdiscovery/nuclei/v3@v3.10.0
```

Technical details

The vulnerability is a security gate bypass in Nuclei's workflow template loader. The main template loader enforces a `-file` flag requirement for file-protocol templates to prevent unintended local file access, but the workflow loader did not perform the same check when resolving template references. When a workflow (which are unsigned by default) references a file-protocol template, the loader accepts and executes it without verifying that the `-file` flag was enabled. An attacker can craft an untrusted workflow to read arbitrary local files from the scanner host. The fix, released in Nuclei v3.10.0, enforces the `-file` gate consistently across all template loading paths.

Affected products

ProjectDiscovery Nuclei before 3.10.0

Identifiers

CVE-2026-76804
GHSA-qgw5-7j4f-fg97
GO-2026-6574

Timeline

2026-09-22: disclosed
2026-09-22: patched: Fix released in Nuclei v3.10.0 via GitHub PR #7489

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.