TI-2026-70829 CVE-2026-108981 · GHSA-5fhq-3m7h-fqv8
Symlink following in ngx_cache_purge lets attackers delete files
Priority LOW 16
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account.