RubyGems passenger 4.0.0 betas 1 and 2 allows remote malicious users to delete arbitrary files during the startup process.
phusion passenger 4.0.0
redhat openshift 1.0