Source: libnginx-mod-http-cache-purge Version: 1:3.0.3-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for libnginx-mod-http-cache-purge. CVE-2026-108981[0]: | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink | attack in certain situations where nginx and a served application | (e.g., WordPress) run under the same user account. The attacker must | be able to create a symlink inside the cache path. Version 3.0.4 | fixes this for the case of a symlink created at an arbitrary earlier | time, but does not resolve an applicable TOCTOU race condition. (The | ngx_cache_purge module follows symlinks while walking the cache | directory tree during purge operations. The module relies on nginx's | ngx_walk_tree(), which relies on stat() and therefore follows | symlinks.) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-108981 https://www.cve.org/CVERecord?id=CVE-2026-108981 [1] https://github.com/nginx-modules/ngx_cache_purge/pull/72 [2] https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
