CVE-2016-10345 Phusion Passenger uses a known /tmp filename

What is CVE-2016-10345?

CVE-2016-10345 is a high-severity path traversal vulnerability in n/a, published on 18 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.

Weakness: CWE-264

Which versions are affected by CVE-2016-10345?

2 open source packages ship an affected version, including passenger. It affects 1 product.

Products include Phusion Passenger.

How do I fix CVE-2016-10345?

Upgrade passenger to 5.1.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-10345 being exploited?

There is no known exploitation of CVE-2016-10345 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-12026 Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability Critical 9.8
• CVE-2018-12027 Insecure Permissions in Phusion Passenger High 8.8
• CVE-2018-12028 Incorrect Access Control in Phusion Passenger High 7.8
• CVE-2012-6135 RubyGems passenger gem allows remote attackers to delete files High 7.5
• CVE-2025-26803 Phusion Passenger denial of service Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-10345, GHSA-cqxw-3p7v-p9gr, SUSE-SU-2017:1316-1, UBUNTU-CVE-2016-10345.