{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-108981",
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "state": "PUBLISHED",
        "assignerShortName": "mitre",
        "dateReserved": "2026-10-12T02:27:14.593Z",
        "datePublished": "2026-10-12T02:27:15.378Z",
        "dateUpdated": "2026-10-12T02:27:15.378Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "modules": [
                        "purge_all",
                        "partial/wildcard key purge",
                        "asynchronous purge queue",
                        "vary-aware variant deletion"
                    ],
                    "product": "ngx_cache_purge",
                    "programFiles": [
                        "ngx_cache_purge_module.c"
                    ],
                    "programRoutines": [
                        {
                            "name": "ngx_http_cache_purge_all"
                        },
                        {
                            "name": "ngx_http_cache_purge_partial"
                        },
                        {
                            "name": "ngx_http_cache_purge_process_queue"
                        },
                        {
                            "name": "ngx_http_cache_purge_delete_variants"
                        }
                    ],
                    "repo": "https://github.com/nginx-modules/ngx_cache_purge",
                    "vendor": "denji",
                    "versions": [
                        {
                            "lessThanOrEqual": "2.5.6",
                            "status": "affected",
                            "version": "2.4.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "3.0.4",
                            "status": "affected",
                            "version": "3.0.0",
                            "versionType": "semver"
                        }
                    ]
                }
            ],
            "configurations": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<code>\n\nnginx built with the ngx_cache_purge module and a proxy, fastcgi, scgi or uwsgi cache path with purge walks in use (purge_all, a wildcard purge, or cache_purge_vary_aware; arbitrary file deletion requires purge_all or a wildcard purge whose key reduces to an empty prefix), and an attacker able to create a symbolic link inside the cache path, for example when nginx and a web application run as the same user. The attacker does not need PURGE access: any legitimate purge of this kind, such as an automatic purge_all issued by a cache plugin, triggers the traversal.\n\n</code>\n\n\n\n<br>"
                        }
                    ],
                    "value": "nginx built with the ngx_cache_purge module and a proxy, fastcgi, scgi or uwsgi cache path with purge walks in use (purge_all, a wildcard purge, or cache_purge_vary_aware; arbitrary file deletion requires purge_all or a wildcard purge whose key reduces to an empty prefix), and an attacker able to create a symbolic link inside the cache path, for example when nginx and a web application run as the same user. The attacker does not need PURGE access: any legitimate purge of this kind, such as an automatic purge_all issued by a cache plugin, triggers the traversal."
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "HIGH",
                        "attackVector": "LOCAL",
                        "availabilityImpact": "LOW",
                        "baseScore": 3.6,
                        "baseSeverity": "LOW",
                        "confidentialityImpact": "NONE",
                        "integrityImpact": "LOW",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-61",
                            "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
                "shortName": "mitre",
                "dateUpdated": "2026-10-12T02:27:15.378Z"
            },
            "references": [
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://github.com/nginx-modules/ngx_cache_purge/pull/72"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96"
                },
                {
                    "url": "https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Fixed in commit a6da135 (PR #72) on the releases/stable-3.0 branch. 2.4 through 2.5.6 users should upgrade to 3.x, or backport the change to the two ngx_walk_tree() call sites in those versions.\n\n\n\n\n\n<br>"
                        }
                    ],
                    "value": "Fixed in commit a6da135 (PR #72) on the releases/stable-3.0 branch. 2.4 through 2.5.6 users should upgrade to 3.x, or backport the change to the two ngx_walk_tree() call sites in those versions."
                }
            ],
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Restrict write access to the cache directories and all of their parent directories to the nginx user only, and do not run nginx and untrusted application code (for example PHP-FPM) as the same user. Remove any symbolic links found inside configured cache paths (find &lt;cache_path&gt; -type l). These measures also limit the similar traversal in nginx's own cache loader, which the fix in the module does not change.\n\n\n\n\n\n<br>"
                        }
                    ],
                    "value": "Restrict write access to the cache directories and all of their parent directories to the nginx user only, and do not run nginx and untrusted application code (for example PHP-FPM) as the same user. Remove any symbolic links found inside configured cache paths (find <cache_path> -type l). These measures also limit the similar traversal in nginx's own cache loader, which the fix in the module does not change."
                }
            ],
            "x_generator": {
                "engine": "CVE-Request-form 0.0.1"
            }
        }
    }
}