{"schema":"threatline.record/2","record":{"id":"CVE-2026-108981","aliases":[],"summary":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker mus","details":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)","categories":["Unclassified"],"product":"ngx_cache_purge","vendor":"denji","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108981","source_modified_at":"2026-10-14T17:18:00.208Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"ngx_cache_purge","vendor":"denji","versions":[{"lessThanOrEqual":"2.5.6","status":"affected","version":"2.4.0","versionType":"semver"},{"lessThan":"3.0.4","status":"affected","version":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108981","source_modified_at":"2026-10-14T17:18:00.208Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"ngx_cache_purge","ecosystem":null},"version":"3.0.4","basis":"first unaffected version stated in the CVE record"}],"cvss":3.6,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00116,"percentile":0.01549,"score_date":"2026-10-23"},"published_at":"2026-10-12T02:27:15.378Z","modified_at":"2026-10-14T17:18:00.208Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108981","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T17:18:00.208Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108981","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nginx-modules/ngx_cache_purge/pull/72","tags":["patch"]},{"source":"CVE List","url":"https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96","tags":["patch"]},{"source":"CVE List","url":"https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T17:17:47.968041Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T17:18:00.208Z","content_hash":"c17e4bae687378b79007dee2c161356819e9012fa55506898a54fb0baedf13d5"}}