CVE-2026-92718
Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 16, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 16, 2026
Description
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.3 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
nucleiprojectdiscovery |
|
References
- GitHub Issue #7663issue-tracking
- https://github.com/projectdiscovery/nucleiproduct
- https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624technical-description
- https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84technical-description
- https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76patch
- VulnCheck Advisory: Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cachethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.