ngx_cache_purge before 3.0.4 processes symbolic links in the cache directory while purging. An attacker who can create a symlink inside a configured cache path can cause the module to follow that link and delete the target file. The flaw is a path traversal vulnerability (CWE‑61) that permits arbitrary file deletion when nginx and the served application run under the same user.

The vulnerability affects denji's ngx_cache_purge module versions 2.4 up to 2.5.6 and any 3.x release prior to 3.0.4. The patch in commit a6da135 was released on the releases/stable‑3.0 branch and is distributed in version 3.0.4. Users of 2.4–2.5.6 must upgrade to 3.x or apply the commit to the two ngx_walk_tree() call sites. The issue is limited to deployments where the cache directory is writable by nginx and the application shares the same user.

The CVSS score of 3.6 indicates low severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker able to write a symlink into a cache directory and having both nginx and the application run under the same privileged user, a configuration that is uncommon in properly segregated environments. Despite the low score, patching remains the recommended action.