CVE-2026-108981: CWE-61 UNIX Symbolic Link (Symlink) Following in denji ngx_cache_purge

The ngx_cache_purge module prior to version 3.0.4 follows symbolic links while walking the cache directory tree during purge operations. Because it relies on nginx's ngx_walk_tree() which uses stat(), symlinks are followed, allowing an attacker who can create symlinks in the cache path to cause deletion of unintended files if nginx and the application run under the same user account. Version 3.0.4 addresses this for symlinks created at arbitrary earlier times but does not fully mitigate a TOCTOU race condition that remains exploitable.

An attacker with the ability to create symlinks in the cache directory can cause unintended file deletions, potentially impacting availability. The vulnerability requires local access or the ability to create symlinks under the same user context as nginx and the application. The CVSS score of 3.6 (low severity) reflects limited impact and attack complexity.

Upgrade ngx_cache_purge to version 3.0.4 or later to address symlink following for symlinks created at arbitrary earlier times. Note that a TOCTOU race condition remains unpatched, so additional caution or mitigations may be necessary. No official patch links were provided; check the vendor's advisory for updates. Restrict permissions to prevent unauthorized symlink creation in the cache directory as a temporary mitigation.