{"id":"CVE-2026-108981","details":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)","modified":"2026-10-13T07:01:41.549343606Z","published":"2026-10-12T02:27:15.378Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108981.json","cna_assigner":"mitre","cwe_ids":["CWE-61"]},"references":[{"type":"WEB","url":"https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108981.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108981"},{"type":"FIX","url":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96"},{"type":"FIX","url":"https://github.com/nginx-modules/ngx_cache_purge/pull/72"},{"type":"PACKAGE","url":"https://github.com/nginx-modules/ngx_cache_purge"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nginx-modules/ngx_cache_purge","events":[{"introduced":"0"},{"last_affected":"1107b8f74ac7a872c1611804ae9df0f5aa4265f9"},{"introduced":"84b30a778ab88ee0f490124bedb91618a0c63e6d"},{"fixed":"a6da1352f52a8a02dd6828e88c39ed42fddcee96"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.4.0"},{"last_affected":"2.5.6"},{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}}],"versions":["2.5.6","3.0.3","3.0.2","3.0.1","3.0.0","2.5.5","2.5.4","2.5.3","2.5.2","2.5.1","2.5","2.4.1","2.4","2.3","2.2","2.1","2.0","1.6","1.5","1.4","1.3","1.2","1.1","1.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96","target":{"file":"ngx_cache_purge_module.c","function":"ngx_http_cache_purge_process_queue"},"deprecated":false,"digest":{"length":2265,"function_hash":"42488412667070391216245842232122802585"},"id":"CVE-2026-108981-2c00f24b"},{"digest":{"function_hash":"328403948350427987632494647305588364099","length":941},"id":"CVE-2026-108981-2dd401df","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96","target":{"file":"ngx_cache_purge_module.c","function":"ngx_http_cache_purge_partial"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"9330872102484916337679959276554229163","length":927},"id":"CVE-2026-108981-70c047a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96","target":{"file":"ngx_cache_purge_module.c","function":"ngx_http_cache_purge_delete_variants"}},{"target":{"file":"ngx_cache_purge_module.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107194538448353258866213937444810481315","101369650343922128951182581026400283771","122266762876558058731263132037496578588","257010542600082173695372802222069866288","320087006805668676824254917023551802907","155362118351256243110022732175160344493","284271028780906753223230919635085158841","338481995276693777632208447986139264272","74224491209418341854105232316716703612","267327508167837079121854874013211589004","198774855207003613850056119082558463411","338481995276693777632208447986139264272","61365270699270435363185948212929120103","202664429487734634691507449901141001969","102319757036324475369505887790344199840","148325552839077597768844376960683208598","89049944512741385506565769421639810620","159854245962562026317023611625061547675","338481995276693777632208447986139264272","202673321100523511204211732495177041857","336867469324160861631238099384570797922","268508444438215165912143213750438920941","338481995276693777632208447986139264272"]},"id":"CVE-2026-108981-91925563","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96"},{"deprecated":false,"digest":{"length":692,"function_hash":"118860006365715410049579663643521483018"},"id":"CVE-2026-108981-afa382d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96","target":{"function":"ngx_http_cache_purge_all","file":"ngx_cache_purge_module.c"}}],"vanir_signatures_modified":"2026-10-13T07:01:41Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108981.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"}]}