Security Alert Summary
The ngx_cache_purge module (denji) contains a vulnerability that can allow file deletion via a symlink attack when nginx and a served application (for example, WordPress) run under the same user account and an attacker can create a symlink inside the cache path. The module follows symlinks while walking the cache directory tree during purge operations, which can lead to unintended file removals in certain situations.
CVE Details
- CVE ID: CVE-2026-108981
- Affected component: ngx_cache_purge (denji)
- Affected versions: Versions 2.4.0 through 2.5.6 (inclusive) and 3.0.0 up to but less than 3.0.4
- Published: October 12, 2026 03:17:18 AM UTC
- Last modified: October 12, 2026 03:17:18 AM UTC
- CVSS v3.1: Base Score 3.6 (LOW) — Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
- Authentication / Privileges / User interaction:
- Authentication: Not indicated as required by CVSS data
- Privileges required: Low
- User interaction: None
- Primary impact: Integrity: Low; Availability: Low; Confidentiality: None
- CWE: CWE-61
Technical Details
The vulnerability arises because the ngx_cache_purge module follows symbolic links while walking the cache directory tree during purge operations. The module relies on nginx’s ngx_walk_tree(), which in turn relies on stat() and follows symlinks. If an attacker is able to create a symlink inside the cache path and the nginx worker and the served application run as the same user, the purge logic can be directed to delete files outside the intended cache boundaries.
The module exposes purge functionality across several routines, including ngx_http_cache_purge_all, ngx_http_cache_purge_partial, ngx_http_cache_purge_process_queue, and ngx_http_cache_purge_delete_variants. According to the report, version 3.0.4 addresses the case of a symlink created at an arbitrary earlier time, but a TOCTOU (time-of-check/time-of-use) race condition that could be applicable is not resolved by that change.
Impact is limited to deletion of files (integrity/availability) rather than direct data disclosure. The attack requires local ability to create a symlink in the cache path and at least low privileges on the host process account.
How This Could Impact Your Website
In a realistic scenario, a site owner operates a WordPress site hosted on an nginx server. Internal staff or external contractors may deploy plugins or build caches under the same system account as nginx. If an attacker with the ability to create a symlink inside the cache path exploits this issue, targeted files could be deleted during a purge. Consequences include partial loss of cached content, temporary content disruption, or availability degradation for certain pages.
For a small team, this might mean an editor or contractor who uploads files or runs maintenance tasks unintentionally creates conditions that a local attacker could exploit, leading to broken pages or increased downtime while caches are rebuilt. While the CVSS data indicates confidentiality impact is none, deletion or modification of cached assets can still increase operational risk and complicate recovery.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected module when a patched version that addresses the specific symlink and race condition issues is available.
- Restrict file system permissions so that nginx and application processes do not run unnecessarily under the same user account.
- Review and reduce unnecessary user roles or service accounts that can write into cache directories, especially for contributors or third-party processes.
- Enforce strong credentials and consider two-factor authentication for administrative accounts and editors where applicable.
- Remove unused or unmaintained modules and limit write access to cache paths to trusted processes only.
- Monitor site and server activity for unusual file deletions or purge operations and maintain recent backups to speed recovery.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
