CVE-2026-108981

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)

• CWE-61

• https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96
• https://github.com/nginx-modules/ngx_cache_purge/pull/72
• https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10897Inappropriate implementation in GPU in Google Chrome prior t…8.8
• CVE-2026-108976GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS co…7.8
• CVE-2026-108978Heap-based buffer overflow vulnerability in Samsung Opensour…5.5
• CVE-2026-108979Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-10898Stack buffer overflow in GPU in Google Chrome prior to 149.0…8.3
• CVE-2026-108980Blinko through 1.8.8 allows directory traversal, overwriting…8.8
• CVE-2026-108982VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows u…7.2
• CVE-2026-108985ZDR decoding in libnfs through 6.0.2 before 7613236 has an o…7.1
• CVE-2026-10899Use after free in Ozone in Google Chrome on Linux prior to 1…7.5
• CVE-2026-1090GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-10900Use after free in Passwords in Google Chrome on Mac prior to…7.5
• CVE-2026-10901Use after free in Passwords in Google Chrome on Mac prior to…7.5