Nuclei Local File Read via Workflow File-Protocol Gate Bypass (CVE-2025-16804)

Vulnerability Summary: Local File Read via Workflow File-Protocol Gate Bypass Vulnerability Overview Vulnerability Type: Local File Read Vulnerability ID: GHSA-qgw5-7j4f-fq97 CVE ID: CVE-2025-16804 Severity: Medium (5.5 / 10) Cause: Flaw in Nuclei's workflow template loading path. The main template loader enforces the flag for protocol templates (security gate), but the workflow loader fails to apply this security gate when parsing templates referenced within workflows. Exploitation Conditions: Since workflows do not have signature verification enabled by default (unsigned by default), an attacker can load and execute protocol templates via unsigned workflows to read local files on the scanner host, even if the operator has not explicitly enabled the flag. Affected Scope Affected Software: Affected Versions: Affected Users: CLI users who run workflows ( ) that reference protocol templates from untrusted or third-party sources. SDK users who integrate Nuclei into platforms that allow end-users to upload workflow files and rely on the default restriction to block local file access. Remediation Fixed Version: Nuclei v3.10.0 Fix Details: In v3.10.0, template execution requirements (including the gate) are consistently enforced in both the main template resolution and request compilation paths. Mitigation Measures: Upgrade to Nuclei v3.10.0. If upgrading is not possible, avoid running workflow files from untrusted sources. Note: No configuration flags in the affected versions can mitigate this bypass. Code/POC The page does not include POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Nuclei Local File Read via Workflow File-Protocol Gate Bypass (CVE-2025-16804)

More from this source