CVE-2026-108981: Race Condition
ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngxcachepurge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngxwalktree(), which relies on stat() and therefore follows symlinks.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ngx_cache_purgeto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Exposure requires nginx and a served application, such as WordPress, to run under the same user account, with the application or another attacker-controlled path able to create a symlink inside the cache path. Deployments that do not permit an attacker to create symlinks in that location are not described as exploitable.
What access does an attacker need?
The attacker needs the ability to create a symlink within the cache directory path. Exploitation is local in the supplied vector and also has high attack complexity.
Does upgrading to version 3.0.4 fully eliminate the risk?
No. Version 3.0.4 fixes the case where a symlink was created at an arbitrary earlier time, but an applicable time-of-check to time-of-use race condition remains.
What can be done if upgrading is not immediately possible?
Prevent untrusted users or applications from creating symlinks inside the cache path, and avoid running nginx and served applications under the same user account where possible. These measures address the stated prerequisites for exploitation.