CVE-2026-108981 Details
Description
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
A vulnerability in the ngx_cache_purge module, affecting versions prior to 3.0.4, allows for arbitrary file deletion through a symlink attack. This issue arises when nginx and the application it serves, such as WordPress, operate under the same user account. An attacker must create a symlink within the cache directory that points to a file outside of it. During cache purge operations, nginx follows these symlinks, leading to unintended file deletions.
Users can upgrade to ngx_cache_purge version 3.0.4 or later, where this vulnerability has been fixed. Instructions for downloading this version are available on the ngx_cache_purge GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96 | [email protected] | Source CodeVendor |
| https://github.com/nginx-modules/ngx_cache_purge/pull/72 | [email protected] | Issue TrackingVendor |
| https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4 | [email protected] | AdvisoryRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ngx_cache_purge | < 3.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |