denji ngx_cache_purge up to 2.5.6/3.0.3 Symlink ngx_walk_tree toctou

Summaryinfo

A vulnerability categorized as problematic has been discovered in denji ngx_cache_purge up to 2.5.6/3.0.3. Affected by this issue is the function ngx_walk_tree of the component Symlink Handler. The manipulation results in toctou. This vulnerability is reported as CVE-2026-108981. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in denji ngx_cache_purge up to 2.5.6/3.0.3. Affected is the function ngx_walk_tree of the component Symlink Handler. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on integrity, and availability. CVE summarizes:

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)

The advisory is available at github.com. This vulnerability is traded as CVE-2026-108981 since 10/12/2026. The exploitability is told to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 364694 (Linux Distros Unpatched Vulnerability : CVE-2026-108981), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (364694) and EUVD (EUVD-2026-97159). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• denji

Name

• ngx_cache_purge

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion