CVE-2026-92718 in Nuclei
Summary
by MITRE • 09/16/2026
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Nuclei versions prior to 3.11.1 represents a critical failure in template integrity verification, specifically within the caching mechanism designed to optimize performance by avoiding redundant cryptographic operations. The core technical flaw lies in the reliance on file modification timestamps rather than content-based checksums for validating cached templates. When Nuclei processes a security scan template, it calculates a signature and stores both the result and metadata about when that validation occurred. Subsequent executions check if the cache is still valid by comparing the current file modification time against the stored timestamp. This approach assumes that any change to the file will alter its modification time, which is a fundamental assumption in many caching systems but fails under specific manipulation scenarios where an attacker can control both the content and the metadata of files on the target system.
An adversary with access to the directory containing Nuclei templates or the ability to influence the environment where Nuclei operates can exploit this logic gap through a time-based cache poisoning attack. The exploitation process involves first obtaining a legitimate, verified template that has been cached by Nuclei. The attacker then replaces the content of this file with malicious code designed to execute arbitrary operating system commands upon execution. Crucially, after modifying the file contents, the attacker manually restores the original modification timestamp using standard filesystem utilities such as touch or chattr on Unix-like systems. Because the modified time remains identical to the one recorded during the initial successful verification, Nuclei’s cache validation logic incorrectly assumes that the template has not changed and proceeds to use it without re-evaluating its cryptographic signature.
The operational impact of this vulnerability is severe, as it allows for remote code execution under conditions where an attacker might have limited but persistent access to the scanning environment or can manipulate shared configuration directories. Since Nuclei is widely used by security professionals and automated pipelines to identify vulnerabilities in web applications and infrastructure services, a compromised template effectively turns the scanner into a vector for attack rather than defense. The malicious code embedded within the template will execute with the privileges of the user running Nuclei, potentially leading to full system compromise, data exfiltration, or lateral movement within an internal network. This undermines the trust model inherent in open-source security tools, where users rely on community-vetted templates for accurate and safe scanning operations.
This flaw aligns closely with CWE-358, which describes improper handling of timestamps, specifically regarding reliance on system time without verifying content integrity. It also relates to CWE-16, known as configuration error involving insecure default configurations or logic flaws in security controls. From an ATT&CK perspective, this vulnerability facilitates the Execution phase through command and script interpretation via compromised artifacts, leveraging techniques associated with artifact manipulation such as T1027. The attack does not require complex exploitation chains but rather a basic understanding of filesystem behavior and cache validation mechanisms, making it accessible to attackers with moderate skill levels who have any degree of influence over the target environment's file system state.
Mitigation strategies must focus on strengthening the integrity verification process within the application logic. For users currently running affected versions, the immediate remediation is to upgrade Nuclei to version 3.11.1 or later, where this caching flaw has been addressed by implementing content-based checksums alongside timestamp checks. This ensures that any alteration to the template file contents invalidates the cache regardless of whether the modification time remains unchanged. Additionally, organizations should enforce strict access controls on directories containing Nuclei templates and configuration files, ensuring that only authorized processes or users can modify these assets. Implementing integrity monitoring solutions such as AIDE or OSSEC can also help detect unauthorized changes to critical security tool configurations in real-time, providing an additional layer of defense against template tampering attacks.