CVE-2026-92718CWE-347

CVE-2026-92718

High · published September 16, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00121 · 1.8th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-16T22:17Z
References (7)
https://github.com/projectdiscovery/nuclei · [email protected]https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84 · [email protected]https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624 · [email protected]https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76 · [email protected]https://github.com/projectdiscovery/nuclei/issues/7663 · [email protected]https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache · [email protected]https://github.com/projectdiscovery/nuclei/issues/7663 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 17:31Z
    Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
    cvelistv5