# CVE-2026-92718: Projectdiscovery Nuclei template signature verification bypass via modification time spoofing

Source: https://junglewise.ai/threats/cve-2026-92718-projectdiscovery-nuclei-template-signature-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92718 · Severity: high · CVSS 7.3 · Published 2026-09-16

Nuclei is a vulnerability scanner that uses digitally signed templates to ensure the authenticity of security checks. Versions before 3.11.1 cache template verification status based only on file modification time without verifying the template content itself. An attacker can replace a verified template with malicious code and restore the original modification time to bypass security checks, allowing arbitrary command execution on systems running the scanner.

Technologies: [ProjectDiscovery Nuclei](https://junglewise.ai/threats/technologies/nuclei). Vendors: [ProjectDiscovery](https://junglewise.ai/threats/vendors/projectdiscovery).

## Quick answers

**Is CVE-2026-92718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92718 being exploited in the wild.

**How severe is CVE-2026-92718?** High severity, with a CVSS score of 7.3, published 16 September 2026.

**Which products and versions are affected?** ProjectDiscovery Nuclei before 3.11.1.

**Is there a fix for CVE-2026-92718?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92718 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-92718?** Check whether you run ProjectDiscovery Nuclei at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Nuclei's template caching logic, which validates cached template signatures using only the file modification time (ModTime) without comparing content checksums. The IsValid() method in the metadata cache compares stored ModTime against the current file modification time; if they match, the cached verification status is trusted without re-validating template content. An attacker with filesystem access can replace a verified template file with unsigned malicious content and restore the original modification time to defeat this check. This allows execution of arbitrary operating system commands through the malicious template. The fix was implemented in version 3.11.1.

## Affected products

- Projectdiscovery Nuclei before 3.11.1

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei)
- [https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go](https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go)

## Related threats

- [Rejected reason: Further research determined the issue results from a dependency.](https://junglewise.ai/threats/cve-2026-76819-projectdiscovery-nuclei-arbitrary-code-execution-via-goja)
- [ProjectDiscovery Nuclei security gate bypass via workflow file-protocol templates](https://junglewise.ai/threats/cve-2026-76804-projectdiscovery-nuclei-security-gate-bypass-via-workflow-file)
- [ProjectDiscovery Nuclei local file read via MySQL sandbox bypass](https://junglewise.ai/threats/cve-2026-76803-projectdiscovery-nuclei-local-file-read-via-mysql-sandbox-bypass)
- [ProjectDiscovery Nuclei arbitrary command execution in DAST template loading](https://junglewise.ai/threats/cve-2026-76802-projectdiscovery-nuclei-arbitrary-command-execution-in-dast)
- [Nuclei: Local File Read via require() Module Loader Bypass](https://junglewise.ai/threats/cve-2026-41646-nuclei-local-file-read-via-require-module-loader-bypass)