# CVE-2026-76804: ProjectDiscovery Nuclei security gate bypass via workflow file-protocol templates

Source: https://junglewise.ai/threats/cve-2026-76804-projectdiscovery-nuclei-security-gate-bypass-via-workflow-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76804 · Severity: medium · CVSS 5.5 · Published 2026-09-22

Nuclei is a vulnerability scanner used by security teams to identify weaknesses in web applications and infrastructure. The tool restricts execution of "file-protocol" templates (which read local files from the scanner host) unless explicitly enabled. An attacker can bypass this restriction by embedding file-protocol templates in an unsigned workflow file, allowing unauthorized local file reads even when the operator disabled file access. This affects users running workflows from untrusted sources.

Technologies: [github.com/projectdiscovery/nuclei (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei), [github.com/projectdiscovery/nuclei/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei-v2), [github.com/projectdiscovery/nuclei/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei-v3), [ProjectDiscovery Nuclei](https://junglewise.ai/threats/technologies/nuclei). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ProjectDiscovery](https://junglewise.ai/threats/vendors/projectdiscovery).

## Quick answers

**Is CVE-2026-76804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76804 being exploited in the wild.

**How severe is CVE-2026-76804?** Medium severity, with a CVSS score of 5.5, published 22 September 2026.

**Which products and versions are affected?** github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.

**Is there a fix for CVE-2026-76804?** Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76804 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76804?** Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later

  ```sh
  go get github.com/projectdiscovery/nuclei/v3@v3.10.0
  ```


## Technical details

The vulnerability is a security gate bypass in Nuclei's workflow template loader. The main template loader enforces a `-file` flag requirement for file-protocol templates to prevent unintended local file access, but the workflow loader did not perform the same check when resolving template references. When a workflow (which are unsigned by default) references a file-protocol template, the loader accepts and executes it without verifying that the `-file` flag was enabled. An attacker can craft an untrusted workflow to read arbitrary local files from the scanner host. The fix, released in Nuclei v3.10.0, enforces the `-file` gate consistently across all template loading paths.

## Affected products

- ProjectDiscovery Nuclei before 3.10.0

## Identifiers

- CVE-2026-76804
- GHSA-qgw5-7j4f-fg97
- GO-2026-6574

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fix released in Nuclei v3.10.0 via GitHub PR #7489

## Related threats

- [Rejected reason: Further research determined the issue results from a dependency.](https://junglewise.ai/threats/cve-2026-76819-projectdiscovery-nuclei-arbitrary-code-execution-via-goja)
- [Nuclei environment variable disclosure in DAST/Fuzz mode](https://junglewise.ai/threats/cve-2026-76805-nuclei-environment-variable-disclosure-in-dast-fuzz-mode)
- [ProjectDiscovery Nuclei local file read via MySQL sandbox bypass](https://junglewise.ai/threats/cve-2026-76803-projectdiscovery-nuclei-local-file-read-via-mysql-sandbox-bypass)
- [ProjectDiscovery Nuclei arbitrary command execution in DAST template loading](https://junglewise.ai/threats/cve-2026-76802-projectdiscovery-nuclei-arbitrary-command-execution-in-dast)
- [Projectdiscovery Nuclei template signature verification bypass via modification time spoofing](https://junglewise.ai/threats/cve-2026-92718-projectdiscovery-nuclei-template-signature-verification-bypass)