CVE-2017-16355: Debian Linux

Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days.

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Affected products

• Debian Debian Linux: version 9.0 only
• Phusion Passenger: from 5.0.10, before 5.1.10 (fixed in 5.1.10); from 5.0.10, before 5.1.11 (fixed in 5.1.11)

Published 2017-12-14. Last modified 2026-06-17.