ngx_cache_purge 3.0.4 Restricts Symlink Traversal
Tech GuruQuick Answer
The ngx_cache_purge maintainer released 3.0.4 to restrict symlink traversal during cache-tree purge operations. The CVE Program record rates the issue 3.6 Low and says an applicable TOCTOU race remains, so update affected modules and prevent untrusted processes from creating cache-path entries.
Separate Cache-Path Write Access And Update ngx_cache_purge
What to do now: Locate loaded ngx_cache_purge modules, confirm affected versions and cache ownership, remove unexpected symlinks, restrict who can write the cache tree, deploy 3.0.4, and validate purge behavior under monitored change control.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ngx_cache_purge for NGINX |
|---|---|
| Advisory | ngx_cache_purge 3.0.4 / CVE-2026-108981 |
| CVE | CVE-2026-108981 |
| Maintainer release date | 2026-10-11 18:15:48 UTC |
| CVE Program record date | 2026-10-12 02:27:15.378 UTC |
| Affected versions | ngx_cache_purge 2.4.0 through 2.5.6 and 3.0.0 before 3.0.4 when an attacker can create a symlink inside the cache path; the authority highlights deployments where NGINX and a served application run under the same account. |
| Fixed version | ngx_cache_purge 3.0.4 for symlinks created at an arbitrary earlier time; the authority says an applicable TOCTOU race remains |
| CVSS base score | 3.6 (CVSS v3.1, CVE Program record) |
| CVSS severity | Low |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The maintainer released 3.0.4 to prevent symlink traversal while walking cache trees. The CVE Program record adds the affected ranges and limitation: ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
What To Validate Now
- Inventory. Record NGINX and ngx_cache_purge versions, module load path, purge directives, cache paths, Unix account and group ownership, served applications, deployment owner, and any process able to create cache entries or symlinks.
- Establish applicability. Confirm both an affected version and a path for a lower-trust process to create a symlink inside the cache tree. Do not infer applicability from NGINX presence alone.
- Remediate. Deploy ngx_cache_purge 3.0.4 from the approved source and restrict cache-directory write access so untrusted application code cannot create cache-tree symlinks; review the authority's remaining race-condition caution.
- Validate. Confirm the loaded module build, inspect cache trees for symlinks, exercise exact and wildcard purge paths, verify permissions and service isolation, and monitor file deletions and NGINX errors.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Version 3.0.4 does not eliminate the authority-described TOCTOU race condition. Run NGINX and lower-trust application code under separate identities where supported, keep cache paths outside application-writable trees, and preserve configuration, ownership, module provenance, test, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
