CVE-2026-92718highCWE-347

CVE-2026-92718: high-severity vulnerability in projectdiscovery nuclei

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Published · Updated

Follow this CVE+ Monitor nuclei

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.1%
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
projectdiscovery · nuclei
Related CVEs — projectdiscovery nuclei

In the same product, most dangerous first.

CVE-2024-43405HIGHNuclei Template Signature Verification BypassEPSS 1.1%CVE-2023-37896HIGHNuclei Path Traversal vulnerabilityEPSS 1.0%CVE-2024-27920HIGHUnsigned code template execution through workflows in projectdiscovery/nucleiEPSS 0.4%CVE-2026-76805MEDIUMNuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz ModeEPSS 0.4%CVE-2026-76803MEDIUMNuclei: Local File Read via MySQL Client Sandbox BypassEPSS 0.4%CVE-2026-41645MEDIUMNuclei: Environment variable disclosure via Response-Derived DSL ExpressionsEPSS 0.4%