Read the docs
TI-2018-08620 Aliases CVE-2018-12027GHSA-whfx-877c-5p28

An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before…

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.

Why it matters now

EPSS 0.01071 65th percentileScored 2026-11-07
Fix Fixed passenger (RubyGems): 5.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—passenger (RubyGems)5.3.0 to before 5.3.25.3.2Patch availableGHSA-whfx-877c-5p28
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • passenger (RubyGems) Vendor— Affected 5.3.0 to before 5.3.2 Fixed in 5.3.2 Patch available GHSA-whfx-877c-5p28

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*5.3.0 to before 5.3.2VulnerablePhusion
  • cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.2 Vulnerable ·Phusion

Remediation

  • Fix · GHSA-whfx-877c-5p28 passenger (RubyGems) Fixed in 5.3.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Ceph Storage 1.3
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 3 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12027
  2. 2026-10-03 Alias added: GHSA-whfx-877c-5p28

References

Advisory 3

Other 2

  • TI-2018-08619 During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion… CVSS 3.0CRITICAL 9.8
  • TI-2025-19710 Use of uninitialized resource in Phusion Passenger CVSS 3.1HIGH 7.5
  • TI-2012-05097 RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. CVSS 3.1HIGH 7.5
  • TI-2018-08621 An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x… CVSS 3.0HIGH 7.8
  • TI-2016-08407 In Phusion Passenger before 5.1.0, a known /tmp filename was used during… CVSS 3.0HIGH 7.8
  • TI-2018-08622 A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2… CVSS 3.0HIGH 7.0
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences