{"id":"DEBIAN-CVE-2026-108981","details":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)","modified":"2026-10-12T10:00:11.321031548Z","published":"2026-10-12T03:17:18.503Z","upstream":["CVE-2026-108981"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-108981"}],"affected":[{"package":{"name":"libnginx-mod-http-cache-purge","ecosystem":"Debian:12","purl":"pkg:deb/debian/libnginx-mod-http-cache-purge?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3-4","1:2.3-5","1:2.3-5~exp1","1:2.3-6","1:2.5.3-1","1:2.5.3-2","1:2.5.3-3","1:2.5.3-4","1:2.5.4-1","1:2.5.5-1","1:2.5.6-1","1:3.0.2-1","1:3.0.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108981.json"}},{"package":{"name":"libnginx-mod-http-cache-purge","ecosystem":"Debian:13","purl":"pkg:deb/debian/libnginx-mod-http-cache-purge?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.3-3","1:2.5.3-4","1:2.5.4-1","1:2.5.5-1","1:2.5.6-1","1:3.0.2-1","1:3.0.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108981.json"}},{"package":{"name":"libnginx-mod-http-cache-purge","ecosystem":"Debian:14","purl":"pkg:deb/debian/libnginx-mod-http-cache-purge?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.3-3","1:2.5.3-4","1:2.5.4-1","1:2.5.5-1","1:2.5.6-1","1:3.0.2-1","1:3.0.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108981.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"}]}