{"id":"UBUNTU-CVE-2026-108981","details":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)","modified":"2026-10-14T03:22:50.892181953Z","published":"2026-10-13T00:00:00Z","upstream":["CVE-2026-108981"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-108981"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-108981"},{"type":"REPORT","url":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96"},{"type":"REPORT","url":"https://github.com/nginx-modules/ngx_cache_purge/pull/72"},{"type":"REPORT","url":"https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4"}],"affected":[{"package":{"name":"libnginx-mod-http-cache-purge","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libnginx-mod-http-cache-purge?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3-5","1:2.3-6","1:2.3-6build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-cache-purge","binary_version":"1:2.3-6build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108981.json"}},{"package":{"name":"libnginx-mod-http-cache-purge","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libnginx-mod-http-cache-purge?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.3-3build1","1:2.5.4-1","1:2.5.4-1build1","1:2.5.5-1","1:2.5.5-1build1","1:2.5.5-1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:2.5.5-1build2","binary_name":"libnginx-mod-http-cache-purge"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108981.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}