Nuclei CVE-2026-76803

Exploitation requires a specific chain of conditions: (1) the target runs an affected Nuclei version 3.0.0 through 3.9.x (CLI or SDK); (2) the operator executes an untrusted/attacker-supplied javascript: template - these run unsigned and without the -code flag on affected versions, so they are not blocked by template signing; (3) the template uses the nuclei/mysql library with a DSN containing the allowAllFiles=true MySQL option; and (4) the scan targets a MySQL-compatible endpoint the attacker controls, which replies with LOAD DATA LOCAL INFILE requests. Critically, the bypass works even when -allow-local-file-access (-lfa) is DISABLED (the default), which is the whole point of the flaw. The limiting factor is UI:R - a human must actively run the malicious template against the malicious endpoint - so it does not affect operators who only run trusted, vetted templates.

The vendor scores this 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), and that vector is a fair characterization: network-reachable and unauthenticated (PR:N) but gated by high complexity (AC:H) and required user interaction (UI:R). The real limiter is UI:R combined with the trust model - exploitation requires the operator to run an untrusted/attacker-supplied javascript: template AND point the scan at an attacker-controlled MySQL-compatible endpoint, so this is not remote-drive-by against a listening service but rather a sandbox-escape that betrays the operator's assumption that -allow-local-file-access (disabled by default) protects them. Impact is confidentiality-only (C:H, arbitrary local file read via LOAD DATA LOCAL INFILE); no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this is a latent access-control weakness, not an urgent in-the-wild threat. The CVSS signals are internally consistent (network vector matches the MySQL-client-to-attacker-server data flow; C:H matches file disclosure). Priority is moderate-to-low for most defenders, higher only for those who ingest and execute untrusted community templates in automated pipelines. Note the input Tag 'Authentication Bypass' is inaccurate - there is no authentication here; this is a local-file-access sandbox bypass (CWE-284).

An attacker publishes a seemingly benign javascript: Nuclei template (which runs unsigned and without the -code flag on 3.0.0-3.9.x) that connects to a MySQL DSN with allowAllFiles=true pointing at a MySQL-compatible server the attacker controls. When a victim runs that template - even with -allow-local-file-access disabled - the malicious server responds to the client's query with LOAD DATA LOCAL INFILE requests for paths like /etc/passwd or credential/config files, and the scanner's MySQL client dutifully reads them and streams the contents back to the attacker's server. No public exploit code was identified at time of analysis, and success requires the victim to actively execute the untrusted template (AC:H, UI:R).