[Pkg-nginx-maintainers] Bug#1151200: libnginx-mod-http-cache-purge: CVE-2026-108981

[Salvatore Bonaccorso]

Source: libnginx-mod-http-cache-purge
Version: 1:3.0.3-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libnginx-mod-http-cache-purge.

CVE-2026-108981[0]:
| ngx_cache_purge before 3.0.4 can allow file deletion via a symlink
| attack in certain situations where nginx and a served application
| (e.g., WordPress) run under the same user account. The attacker must
| be able to create a symlink inside the cache path. Version 3.0.4
| fixes this for the case of a symlink created at an arbitrary earlier
| time, but does not resolve an applicable TOCTOU race condition. (The
| ngx_cache_purge module follows symlinks while walking the cache
| directory tree during purge operations. The module relies on nginx's
| ngx_walk_tree(), which relies on stat() and therefore follows
| symlinks.)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108981
    https://www.cve.org/CVERecord?id=CVE-2026-108981
[1] https://github.com/nginx-modules/ngx_cache_purge/pull/72
[2] https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore