CVE-2026-108981
Summary
| CVE | CVE-2026-108981 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-12 03:17:18 UTC |
| Updated | 2026-10-16 19:56:15 UTC |
| Description | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.) |
Risk And Classification
Primary CVSS: v3.1 3.6 LOW from [email protected]
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS: 0.001160000 probability, percentile 0.015220000 (date 2026-10-16)
Problem Types: CWE-61 | CWE-61 CWE-61 UNIX Symbolic Link (Symlink) Following
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 3.6 | LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| 3.1 | CNA | CVSS | 3.6 | LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Denji | Ngx Cache Purge | affected 2.4.0 2.5.6 semver | Not specified |
| CNA | Denji | Ngx Cache Purge | affected 3.0.0 3.0.4 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/nginx-modules/ngx_cache_purge/pull/72 | [email protected] | github.com | |
| github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e8... | [email protected] | github.com | |
| github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Fixed in commit a6da135 (PR #72) on the releases/stable-3.0 branch. 2.4 through 2.5.6 users should upgrade to 3.x, or backport the change to the two ngx_walk_tree() call sites in those versions.
Workarounds
CNA: Restrict write access to the cache directories and all of their parent directories to the nginx user only, and do not run nginx and untrusted application code (for example PHP-FPM) as the same user. Remove any symbolic links found inside configured cache paths (find <cache_path> -type l). These measures also limit the similar traversal in nginx's own cache loader, which the fix in the module does not change.