CVE-2018-12029

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.

• CWE-362

• https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00007.htmlMailing List, Third Party Advisory
• https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-escThird Party Advisory
• https://security.gentoo.org/glsa/201807-02Third Party Advisory
• https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00007.htmlMailing List, Third Party Advisory
• https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-escThird Party Advisory
• https://security.gentoo.org/glsa/201807-02Third Party Advisory

Published

Jun 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12022An issue was discovered in FasterXML jackson-databind prior …7.5
• CVE-2018-12023An issue was discovered in FasterXML jackson-databind prior …
• CVE-2018-12025The transferFrom function of a smart contract implementation…
• CVE-2018-12026During the spawning of a malicious Passenger-managed applica…
• CVE-2018-12027An Insecure Permissions vulnerability in SpawningKit in Phus…
• CVE-2018-12028An Incorrect Access Control vulnerability in SpawningKit in …
• CVE-2018-1203In Dell EMC Isilon OneFS, the compadmin is able to run tcpdu…
• CVE-2018-12030Chevereto Free before 1.0.13 has XSS.
• CVE-2018-12031Local file inclusion in Eaton Intelligent Power Manager v1.6…
• CVE-2018-12034In YARA 3.7.1 and prior, parsing a specially crafted compile…
• CVE-2018-12035In YARA 3.7.1 and prior, parsing a specially crafted compile…
• CVE-2018-12036OWASP Dependency-Check before 3.2.0 allows attackers to writ…