Symlink Attack Vulnerability in Nginx ngx_cache_purge Module Affecting WordPress

CVE-2026-108981

What is CVE-2026-108981?

The ngx_cache_purge module before version 3.0.4 contains a vulnerability that permits file deletion through a symlink attack under specific circumstances. This situation arises when Nginx and an application like WordPress operate under the same user account, allowing an attacker with appropriate permissions to create a symlink within the cache path. Although version 3.0.4 addresses the issue of symlinks created at an arbitrary time, it does not eliminate the related Time of Check to Time of Use (TOCTOU) race condition. The ngx_cache_purge module's design allows following symlinks while removing cached data, creating potential exploitation avenues.

References