Ngx Cache Purge
Monthly
Symlink following in the nginx third-party module ngx_cache_purge before 3.0.4 allows a local attacker to cause deletion of files outside the configured proxy_cache_path: the module's purge walks (purge_all, wildcard purge, or a plain proxy_cache_purge PURGE request) trust nginx's ngx_walk_tree(), which classifies directory entries with stat() and therefore descends into planted symlinks. Exploitation is narrow - it requires that nginx and a served application such as WordPress run under the same OS user account and that the attacker already has that user's file-write or code-execution capability to plant the link - and no public exploit code or confirmed in-the-wild activity was identified at time of analysis, with the assessed CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) reflecting a genuinely low-priority, local-only, high-complexity issue. Version 3.0.4 blocks symlinks found inside the cache tree but does not close an applicable TOCTOU race condition, so the shared-user deployment remains the decisive risk factor.
Symlink following in the nginx third-party module ngx_cache_purge before 3.0.4 allows a local attacker to cause deletion of files outside the configured proxy_cache_path: the module's purge walks (purge_all, wildcard purge, or a plain proxy_cache_purge PURGE request) trust nginx's ngx_walk_tree(), which classifies directory entries with stat() and therefore descends into planted symlinks. Exploitation is narrow - it requires that nginx and a served application such as WordPress run under the same OS user account and that the attacker already has that user's file-write or code-execution capability to plant the link - and no public exploit code or confirmed in-the-wild activity was identified at time of analysis, with the assessed CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) reflecting a genuinely low-priority, local-only, high-complexity issue. Version 3.0.4 blocks symlinks found inside the cache tree but does not close an applicable TOCTOU race condition, so the shared-user deployment remains the decisive risk factor.