{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "2.4.0"
              },
              {
                "last_affected": "2.5.6"
              },
              {
                "introduced": "3.0.0"
              },
              {
                "fixed": "3.0.4"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1107b8f74ac7a872c1611804ae9df0f5aa4265f9"
            },
            {
              "introduced": "84b30a778ab88ee0f490124bedb91618a0c63e6d"
            },
            {
              "fixed": "a6da1352f52a8a02dd6828e88c39ed42fddcee96"
            }
          ],
          "repo": "https://github.com/nginx-modules/ngx_cache_purge",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "mitre",
    "cwe_ids": [
      "CWE-61"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108981.json"
  },
  "details": "ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)",
  "id": "CVE-2026-108981",
  "modified": "2026-10-15T02:31:04.041632883Z",
  "published": "2026-10-12T02:27:15.378Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108981.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108981"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nginx-modules/ngx_cache_purge/pull/72"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nginx-modules/ngx_cache_purge"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}