Every CVE Search/ Get API key

CVE-2013-4136

insecure temporary directory usage in passenger

4.4 MediumFix available

CVE-2013-4136 is a medium vulnerability (CVSS 4.4) in Phusion Passenger, published August 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in passenger 4.0.6.

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Exploit likelihood

0.33%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.4

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
CVE-2013-4136
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
CVE-2013-4136
Updated
2026-11-02
EUVDEUVD-2017-0321 No score

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
EUVD-2017-0321
Updated
2026-11-03
GitHub AdvisoriesGHSA-w6rc-q387-vpgq No score

insecure temporary directory usage in passenger

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
GHSA-w6rc-q387-vpgq
Weakness
CWE-59
Updated
2026-11-02
OSV No score

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
CVE-2013-4136
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4136 No score

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
DEBIAN-CVE-2013-4136
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-w6rc-q387-vpgq No score

insecure temporary directory usage in passenger

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
GHSA-w6rc-q387-vpgq
Weakness
CWE-59
Updated
2026-11-02
OSVMGASA-2013-0253 No score

Updated rubygem-passenger package fixes CVE-2013-4136 & apache module

Updated rubygem-passenger package fixes security vulnerability:

It was reported that Phusion Passenger would reuse existing server instance directories (temporary directories) which could cause Passenger to remove or overwrite files belonging to other instances (CVE-2013-4136).

Additionally, the package has been fixed so that the Apache module should load.

Record
MGASA-2013-0253
Updated
2026-11-02
OSVSUSE-SU-2016:0042-1 No score

Security update for rubygem-passenger

This update fixes the following security issues:

  • CVE-2015-7519: Passenger is not filtering environment like apache is doing (bnc#956281)

  • CVE-2013-4136: Fixed security issue Passenger would reuse existing server instance directories (temporary directories) which could cause Passenger to remove or overwrite files belonging to other instances. Solution: If the server instance directory already exists, it will now be removed first in order get correct directory permissions. If the directory still exists after removal, Phusion Passenger aborts to avoid writing to a directory with unexpected permissions.(bnc#919726)

  • CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)

Record
SUSE-SU-2016:0042-1
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4136 No score

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Record
UBUNTU-CVE-2013-4136
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
passenger
RubyGems
 before 4.0.6
4.0.6
passenger
Debian:12
 before 3.0.13debian-1.2
3.0.13debian-1.2
passenger
Debian:13
 before 3.0.13debian-1.2
3.0.13debian-1.2
passenger
Debian:14
 before 3.0.13debian-1.2
3.0.13debian-1.2
passenger
RubyGems
 before 4.0.6, plus listed versions
1.0.11.0.21.0.31.0.41.0.5
Show 45 moreShow less
2.0.12.0.22.0.32.0.42.0.52.0.62.1.22.1.32.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.93.0.03.0.0.pre13.0.0.pre23.0.0.pre33.0.0.pre43.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.173.0.183.0.193.0.23.0.213.0.33.0.43.0.53.0.6
4.0.6
rubygem-passenger
Mageia:3
 before 3.0.21-2.2.mga3
3.0.21-2.2.mga3
mod_passenger
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-mod_passenger
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-rubygem-passenger
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-rubygem-passenger-debuginfo
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
Show 17 moreShow less
Affected packages
PackageAffectedFixed
ruby193-rubygem-passenger-devel
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-rubygem-passenger-doc
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-rubygem-passenger-native
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
ruby193-rubygem-passenger-native-libs
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-file-tail
Red Hat:openshift:1.2::el6
 before 0:1.0.5-4.el6op
0:1.0.5-4.el6op
rubygem-file-tail-doc
Red Hat:openshift:1.2::el6
 before 0:1.0.5-4.el6op
0:1.0.5-4.el6op
rubygem-passenger
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-passenger-debuginfo
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-passenger-devel
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-passenger-doc
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-passenger-native
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-passenger-native-libs
Red Hat:openshift:1.2::el6
 before 0:3.0.21-3.el6op
0:3.0.21-3.el6op
rubygem-spruz
Red Hat:openshift:1.2::el6
 before 0:0.2.5-4.el6op
0:0.2.5-4.el6op
rubygem-spruz-doc
Red Hat:openshift:1.2::el6
 before 0:0.2.5-4.el6op
0:0.2.5-4.el6op
rubygem-passenger
SUSE:Lifecycle Management Server 1.3
 before 3.0.14-0.14.1
3.0.14-0.14.1
rubygem-passenger
SUSE:Studio Onsite 1.3
 before 3.0.14-0.14.1
3.0.14-0.14.1
rubygem-passenger
SUSE:WebYast 1.3
 before 3.0.14-0.14.1
3.0.14-0.14.1

History

History
WhenChangedSources
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 26 moreShow less
This page doesn't list everything

Left out here: 12 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open