CVE-2026-108981 | denji ngx_cache_purge up to 2.5.6/3.0.3 Symlink ngx_walk_tree toctou

October 12, 2026 Yanac

A vulnerability was found in denji ngx_cache_purge up to 2.5.6/3.0.3. It has been rated as problematic. Affected by this vulnerability is the function ngx_walk_tree of the component Symlink Handler. The manipulation leads to time-of-check time-of-use.

This vulnerability is documented as CVE-2026-108981. The attack needs to be performed locally. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More