CVE-2018-12026

CVE-2018-12026 is a critical vulnerability affecting Phusion Passenger versions 5.3.x before 5.3.2. It allows a malicious Passenger-managed application to replace critical files in the spawning communication directory with symlinks, leading to arbitrary reads and writes. This could result in severe information disclosure and privilege escalation. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with no user interaction required. Despite its high severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.