nginx-module-cache-purge -- symlink traversal when walking cache trees

2026-10-15 · CVE-2026-108981 · VuXML entry

The ngx_cache_purge developers report: Fixed a symlink traversal vulnerability during cache tree traversal. An attacker with the ability to create symbolic links inside the cache directory could potentially cause cache purge operations to delete arbitrary files accessible to the NGINX worker process (CVE-2026-108981).

Affected versions

• nginx-module-cache-purge < 3.0.4

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.