Nuclei, a YAML-based vulnerability scanner, allowed an unsigned workflow to reference a file: protocol template, bypassing the intended file-capability gate. The flaw, a CWE-284 Improper Access Control, permits the scanner process to read any file reachable to it, exposing sensitive data on the host. The vulnerability is localized to the scanner’s environment but can compromise confidentiality when the scanner runs with elevated privileges.

The issue affects projectdiscovery:nuclei versions from 3.0.0 up to 3.9.x. Both command-line users employing the -w flag and SDK integrations that accept end-user workflows without enabling the file capability gate are impacted. The problem is resolved in release 3.10.0.

The CVSS score of 5.5 rates the vulnerability as moderate, while the EPSS score is not available so the exploitation probability remains unknown. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a user or CI system that can provide a malicious workflow. The exploit requires the ability to run Nuclei with the malicious workflow; if the scanner operates with privileged credentials, the read can extend to protected files, increasing impact. No remote exploitation path is documented from the public data.