# passenger (RubyGems) vulnerabilities Source: https://junglewise.ai/threats/technologies/passenger Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/passenger.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in passenger (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-26803, was published on 24 February 2025. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 14 (0 critical, 0 exploited in the wild) ## About passenger (RubyGems) Ruby application server and process manager for deploying web applications. ## Latest passenger (RubyGems) vulnerabilities - [CVE-2025-26803: Phusion Passenger denial of service](https://junglewise.ai/threats/cve-2025-26803-phusion-passenger-denial-of-service) (low, CVSS 3.1, published 24 Feb 2025) - [CVE-2018-12026: Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability](https://junglewise.ai/threats/cve-2018-12026-phusion-passenger-spawningkit-contains-arbitrary-read-write) (low, CVSS 3, published 14 May 2022) - [CVE-2018-12029: Phusion Passenger Race Condition Allows Privilege Escalation](https://junglewise.ai/threats/cve-2018-12029-phusion-passenger-race-condition-allows-privilege-escalation) (low, CVSS 3, published 14 May 2022) - [CVE-2018-12615: Phusion Passenger incorrect permission assignment](https://junglewise.ai/threats/cve-2018-12615-phusion-passenger-incorrect-permission-assignment) (low, CVSS 3, published 13 May 2022) - [CVE-2018-12027: Insecure Permissions in Phusion Passenger](https://junglewise.ai/threats/cve-2018-12027-insecure-permissions-in-phusion-passenger) (low, CVSS 3.1, published 13 May 2022) - [CVE-2018-12028: Incorrect Access Control in Phusion Passenger](https://junglewise.ai/threats/cve-2018-12028-incorrect-access-control-in-phusion-passenger) (low, CVSS 3, published 13 May 2022) - [CVE-2017-16355: Phusion Passenger information disclosure](https://junglewise.ai/threats/cve-2017-16355-phusion-passenger-information-disclosure) (low, CVSS 3.1, published 13 May 2022) - [CVE-2012-6135: RubyGems passenger gem allows remote attackers to delete files](https://junglewise.ai/threats/cve-2012-6135-rubygems-passenger-gem-allows-remote-attackers-to-delete-files) (low, CVSS 3.1, published 23 Apr 2022) - [CVE-2014-1832: Insecure use of temporary files in Phusion passenger](https://junglewise.ai/threats/cve-2014-1832-insecure-use-of-temporary-files-in-phusion-passenger) (info, published 10 Oct 2018) - [CVE-2014-1831: Insecure use of temporary files in passenger](https://junglewise.ai/threats/cve-2014-1831-insecure-use-of-temporary-files-in-passenger) (info, published 10 Oct 2018) - [CVE-2015-7519: Phusion Passenger allows remote attackers to spoof headers](https://junglewise.ai/threats/cve-2015-7519-phusion-passenger-allows-remote-attackers-to-spoof-headers) (low, CVSS 3, published 10 Oct 2018) - [CVE-2016-10345: Phusion Passenger uses a known /tmp filename](https://junglewise.ai/threats/cve-2016-10345-phusion-passenger-uses-a-known-tmp-filename) (low, CVSS 3, published 21 Aug 2018) - [CVE-2013-2119: Phusion Passenger Denial of Service](https://junglewise.ai/threats/cve-2013-2119-phusion-passenger-denial-of-service) (info, published 24 Oct 2017) - [CVE-2013-4136: insecure temporary directory usage in passenger](https://junglewise.ai/threats/cve-2013-4136-insecure-temporary-directory-usage-in-passenger) (info, published 24 Oct 2017) ## Most severe passenger (RubyGems) vulnerabilities - [CVE-2012-6135: RubyGems passenger gem allows remote attackers to delete files](https://junglewise.ai/threats/cve-2012-6135-rubygems-passenger-gem-allows-remote-attackers-to-delete-files) (low, CVSS 3.1, published 23 Apr 2022) - [CVE-2018-12027: Insecure Permissions in Phusion Passenger](https://junglewise.ai/threats/cve-2018-12027-insecure-permissions-in-phusion-passenger) (low, CVSS 3.1, published 13 May 2022) - [CVE-2025-26803: Phusion Passenger denial of service](https://junglewise.ai/threats/cve-2025-26803-phusion-passenger-denial-of-service) (low, CVSS 3.1, published 24 Feb 2025) - [CVE-2017-16355: Phusion Passenger information disclosure](https://junglewise.ai/threats/cve-2017-16355-phusion-passenger-information-disclosure) (low, CVSS 3.1, published 13 May 2022) - [CVE-2015-7519: Phusion Passenger allows remote attackers to spoof headers](https://junglewise.ai/threats/cve-2015-7519-phusion-passenger-allows-remote-attackers-to-spoof-headers) (low, CVSS 3, published 10 Oct 2018) - [CVE-2018-12026: Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability](https://junglewise.ai/threats/cve-2018-12026-phusion-passenger-spawningkit-contains-arbitrary-read-write) (low, CVSS 3, published 14 May 2022) - [CVE-2018-12615: Phusion Passenger incorrect permission assignment](https://junglewise.ai/threats/cve-2018-12615-phusion-passenger-incorrect-permission-assignment) (low, CVSS 3, published 13 May 2022) - [CVE-2018-12028: Incorrect Access Control in Phusion Passenger](https://junglewise.ai/threats/cve-2018-12028-incorrect-access-control-in-phusion-passenger) (low, CVSS 3, published 13 May 2022) - [CVE-2016-10345: Phusion Passenger uses a known /tmp filename](https://junglewise.ai/threats/cve-2016-10345-phusion-passenger-uses-a-known-tmp-filename) (low, CVSS 3, published 21 Aug 2018) - [CVE-2018-12029: Phusion Passenger Race Condition Allows Privilege Escalation](https://junglewise.ai/threats/cve-2018-12029-phusion-passenger-race-condition-allows-privilege-escalation) (low, CVSS 3, published 14 May 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other RubyGems technologies - [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack): 77 vulnerabilities - [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities - [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities - [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities - [rubygems-update (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-update): 25 vulnerabilities - [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet): 23 vulnerabilities - [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities - [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities - [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities - [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities - [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities - [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "passenger (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/passenger, 13 November 2026.