The vulnerability in the nuclei/projectdiscovery:nuclei software allows an attacker to read arbitrary local files on the scanner host. By providing an untrusted JavaScript template that connects to a malicious MySQL-compatible endpoint and includes the allowAllFiles option, the server can issue LOAD DATA LOCAL INFILE requests for any path. The JavaScript library does not enforce the local-file sandbox on affected versions, so the scanner’s MySQL client reads those files and returns their contents to the caller even though the –allow-local-file-access flag is disabled. This flaw can expose sensitive configuration, credentials, or other system files, potentially enabling further exploitation. The weakness is a CWE‑284 improper authorization issue.

Product: Nuclei (repository projectdiscovery:nuclei). Affected releases include versions 3.0.0 through 3.10.0, inclusive. All deployments that consume untrusted JavaScript templates via the CLI or SDK are vulnerable, regardless of whether the –code flag is used.

The CVSS score of 5.3 reflects a medium severity local file read that could lead to confidentiality disclosure. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack vector is inferred to be remote: an adversary supplies a malicious template to a scanner that connects to an attacker‑controlled MySQL endpoint. Conditions for exploitation include running an affected version of Nuclei, accepting an untrusted template, and allowing the allowAllFiles MySQL DSN option. Once satisfied, the scanner will fetch and return arbitrary file contents to the attacker.