Every CVE Search/ Get API key

CVE-2017-16355

Phusion Passenger information disclosure

4.7 MediumFix available

CVE-2017-16355 is a medium vulnerability (CVSS 4.7) in Phusion Passenger, published December 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in passenger 5.1.11.

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.36%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.7

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
CVE-2017-16355
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
1.2 LowAV:L/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
CVE-2017-16355
Updated
2026-11-02
EUVDEUVD-2022-3633 No score

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
EUVD-2022-3633
Updated
2026-11-03
GitHub AdvisoriesGHSA-cv3f-px9r-54hm 4.7

Phusion Passenger information disclosure

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
GHSA-cv3f-px9r-54hm
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 4.7

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
CVE-2017-16355
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-16355 4.7

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
DEBIAN-CVE-2017-16355
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-cv3f-px9r-54hm 4.7

Phusion Passenger information disclosure

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
GHSA-cv3f-px9r-54hm
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVUBUNTU-CVE-2017-16355 4.7

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Record
UBUNTU-CVE-2017-16355
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVSUSE-SU-2018:0262-1 No score

Security update for rubygem-passenger

This update for rubygem-passenger fixes several issues.

These security issues were fixed:

  • CVE-2017-16355: When Passenger was running as root it was possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml (bsc#1073255).
  • CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run with root permissions while the directory permissions of (parts of) its root dir allow modifications by non-root users (bsc#1068874).
Record
SUSE-SU-2018:0262-1
Updated
2026-11-02
OSVUSN-5261-1 No score

passenger vulnerabilities

It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)

It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to perform a symlink attack. An attacker could possibly use this issue to escalate privileges. (CVE-2018-12029)

Record
USN-5261-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
passenger
RubyGems
 before 5.1.11
5.1.11
passenger
Debian:12
 before 5.0.30-1.1
5.0.30-1.1
passenger
Debian:13
 before 5.0.30-1.1
5.0.30-1.1
passenger
Debian:14
 before 5.0.30-1.1
5.0.30-1.1
passenger
Debian:9
 before 5.0.30-1+deb9u1, plus listed versions
5.0.30-1
5.0.30-1+deb9u1
passenger
RubyGems
 before 5.1.11, plus listed versions
1.0.11.0.21.0.31.0.41.0.5
Show 45 moreShow less
2.0.12.0.22.0.32.0.42.0.52.0.62.1.22.1.32.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.93.0.03.0.0.pre13.0.0.pre23.0.0.pre33.0.0.pre43.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.173.0.183.0.193.0.23.0.213.0.33.0.43.0.53.0.6
5.1.11
rubygem-passenger
SUSE:Linux Enterprise Module for Containers 12
 before 5.0.18-12.5.1
5.0.18-12.5.1
passenger
Ubuntu:Pro:16.04:LTS
 before 5.0.27-2ubuntu0.1~esm1, plus listed versions
5.0.7-35.0.22-15.0.22-1build15.0.22-1build25.0.27-2
5.0.27-2ubuntu0.1~esm1
passenger
Ubuntu:18.04:LTS
 before 5.0.30-1+deb9u1build0.18.04.1, plus listed versions
5.0.30-15.0.30-1build15.0.30-1build2
5.0.30-1+deb9u1build0.18.04.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 13 moreShow less
This page doesn't list everything

Left out here: 105 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open