Description
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | passenger | 5.0.30-1.1 | — |
| Debian 13 | passenger | 5.0.30-1.1 | — |
| Debian 12 | passenger | 5.0.30-1.1 | — |
| Debian 8 | ruby-passenger | 4.0.53-1+deb8u1 | DLA-1399-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | passenger | 5.0.30-1+deb9u1build0.18.04.1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | passenger | 5.0.27-2ubuntu0.1~esm1 | USN-5261-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | rubygem-passenger | 5.0.18-12.9.1 | SUSE-SU-2018:2039-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | passenger | >= 3.0.0, < 5.3.2 | 5.3.2 | GHSA-jjcj-fgfm-9g9r |
Advisories 3
- USN-5261-1 passenger vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-1399-1 ruby-passenger - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:2039-1 Security update for rubygem-passenger SUSE / openSUSE Security Updates · Feb 4, 2026