CVE-2026-92718

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92718
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92718.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92718
Published
2026-09-16T17:31:38Z
Modified
2026-09-19T03:30:29Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache
Details

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92718.json"
}
References

Affected packages

Git / github.com/projectdiscovery/nuclei

Affected ranges

Type
GIT
Repo
https://github.com/projectdiscovery/nuclei
Events
Introduced
4a8b83f977078e4adc3594e30e4b7458da7a57a1
Fixed
a8c88feb4a1c8e961b7902534ce3af97e9d524a4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.11.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.10.0
v3.11.0
v3.7.0
v3.7.1
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92718.json"