CVE-2025-26803

CVE-2025-26803 affects Phusion Passenger: the http parser in versions 6.0.21–6.0.25 (before 6.0.26) is vulnerable to denial of service when parsing a request with an invalid HTTP method. The issue is mitigated by upgrading to Passenger 6.0.26 or later. No exploitation details are provided in the ...

CVE-2017-16355

CVE-2017-16355 affects Phusion Passenger 5.1.10 (fixed in Open Source 5.1.11 and Enterprise 5.1.10). When Passenger runs as root, an attacker can read arbitrary files by symlinking the REVISION file from the application root to a target file and querying passenger-status --show=xml, enabling a lo...

CVE-2013-2119

Phusion Passenger gem vulnerability (CVE-2013-2119) affects Phusion Passenger for Ruby, specifically the gem versions before 3.0.21 and 4.0.x before 4.0.5. The issue arises from insecure handling of temporary directories/files in /tmp, where a local attacker can pre-create a predictable temporary...

CVE-2018-12029

CVE-2018-12029 describes a race condition in the Phusion Passenger nginx module (3.x–5.x) before 5.3.2. If a non-standard passenger_instance_registry_dir with weak permissions is configured, a race can occur after a file is created but before chown, where replacing the file with a symlink targets...

CVE-2018-12028

CVE-2018-12028 : An Incorrect Access Control vulnerability exists in SpawningKit, part of Phusion Passenger 5.3.x, reported before 5.3.2. A Passenger-managed malicious application, when spawning a child process, can report an arbitrary different PID to Passenger’s process manager. If that applica...

CVE-2016-10345

CVE-2016-10345 affects Phusion Passenger prior to 5.1.0, where a known /tmp filename used during passenger-install-nginx-module execution could allow a local attacker to gain the privileges of the passenger user. The vulnerability is local and depends on the /tmp filename handling during installa...

CVE-2012-6135

CVE-2012-6135 affects Phusion Passenger RubyGem (RubyGems passenger) versions 4.0.0 beta1/beta2. The startup routine can be abused to delete arbitrary files. Exploitation context varies by source: NVD/SUSE/GHSA imply remote access, while the RubySec advisory notes a local attacker during startup....

CVE-2013-4136

CVE-2013-4136 affects the Phusion Passenger gem for Ruby (pre-4.0.6). The issue arises when Passenger reuses or creates temporary server instance directories in /tmp with predictable names, enabling a local attacker to perform a symlink attack that could change ownership or remove/overwrite files...

CVE-2014-1831

Phusion Passenger (before 4.0.37) is affected by CVE-2014-1831: local users can write to certain files and directories through a symlink attack targeting control_process.pid or a generation-* file. Described in NVD with a low severity (CVSSv2 base score 2.1) and local access prerequisite. Connect...

CVE-2018-12026

CVE-2018-12026 describes a vulnerability in Phusion Passenger’s SpawningKit for the 5.3.x line prior to 5.3.2. During spawning, an attacker could cause the spawning communication directory to accept symlinks, enabling arbitrary reads and writes that may lead to information disclosure and privileg...

CVE-2018-12615

Phusion Passenger (before 5.3.2) is affected by CVE-2018-12615. The issue is in switchGroup() (agent/ExecHelper/ExecHelperMain.cpp): the gidset controlling supplementary groups is not set correctly, leaving it up to randomness (uninitialized memory) to determine which groups are actually applied ...

CVE-2018-12027

Summary of CVE-2018-12027 (Phusion Passenger) : This vulnerability affects Phusion Passenger 5.3.x before 5.3.2, specifically the SpawningKit component. If a Passenger-spawned application reports a Unix domain socket and any parent directory of that socket is writable by a non‑application user, t...

CVE-2014-1832

CVE-2014-1832 affects Phusion Passenger 4.0.37 and is caused by insecure handling of temporary files, enabling a local attacker to perform a symbolic/link attack on (1) control_process.pid or (2) generation-* files. This allows writing to certain files/directories with local access. The issue ari...