What’s Vulnerable › Vulnerabilities

CVE-2018-12026

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-17 · updated 2026-06-17
• Weakness: CWE-59

Description

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.

Affected products

• Phusion Passenger: from 5.3.0 before 5.3.2 — fixed in 5.3.2

How to fix

Upgrade to a fixed version: Phusion Passenger 5.3.2. Check the vendor advisory for mitigations.

References

• https://blog.phusion.nl/passenger-5-3-2
• https://security.gentoo.org/glsa/201807-02
• https://blog.phusion.nl/passenger-5-3-2
• https://security.gentoo.org/glsa/201807-02

Get alerted when CVE-2018-12026 or the next vulnerability affects your stack