CVE-2017-16355

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

• CWE-200

• https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/Third Party Advisory
• https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bfPatch, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/34Issue Tracking, Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4415Third Party Advisory
• https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/Third Party Advisory
• https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bfPatch, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/34Issue Tracking, Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4415Third Party Advisory

Published

Dec 14, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16349An exploitable XML external entity vulnerability exists in t…8.1
• CVE-2017-1635IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attack…
• CVE-2017-16350Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16352GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer o…
• CVE-2017-16353GraphicsMagick 1.3.26 is vulnerable to a memory information …
• CVE-2017-16356Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery …
• CVE-2017-16357In radare 2.0.1, a memory corruption vulnerability exists in…
• CVE-2017-16358In radare 2.0.1, an out-of-bounds read vulnerability exists …
• CVE-2017-16359In radare 2.0.1, a pointer wraparound vulnerability exists i…
• CVE-2017-16360An issue was discovered in Adobe Acrobat and Reader: 2017.01…
• CVE-2017-16361An issue was discovered in Adobe Acrobat and Reader: 2017.01…