What’s Vulnerable › Vulnerabilities

CVE-2026-92718: Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-24
• Weakness: CWE-347

Description

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

Affected products

• projectdiscovery nuclei: from 3.7.0 before 3.11.1 — fixed in 3.11.1

How to fix

Upgrade to a fixed version: projectdiscovery nuclei 3.11.1. Check the vendor advisory for mitigations.

References

• https://github.com/projectdiscovery/nuclei
• https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84
• https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624
• https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76
• https://github.com/projectdiscovery/nuclei/issues/7663
• https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache
• https://github.com/projectdiscovery/nuclei/issues/7663

Get alerted when CVE-2026-92718 or the next vulnerability affects your stack