CVE-2025-27591

🗓️ 11 Mar 2025 18:29:21Reported by facebookType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 517 Views🌐 WEB

Privileged escalation vulnerability in Below service allows local users to access root privileges.

Reporter	Title	Published	Views	Family All 37
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Aug 202511:54	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	18 Jul 202503:26	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Jul 202522:17	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	2 Jan 202611:20	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202505:14	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Apr 202601:18	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Jul 202522:31	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	20 Jul 202504:33	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Nov 202519:56	–	githubexploit
GithubExploit	Exploit for CVE-2025-27519	22 Aug 202508:05	–	githubexploit

NVD

Node

facebook belowRange<0.9.0rust

[
  {
    "defaultStatus": "unaffected",
    "product": "below",
    "vendor": "Meta Platforms, Inc",
    "versions": [
      {
        "lessThan": "0.9.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
facebook	www.facebook.com/security/advisories/cve-2025-27591
github	www.github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
openwall	www.openwall.com/lists/oss-security/2025/03/12/1

Parameter	Position	Path	Description	CWE
error_root.log	path	/var/log/below/error_root.log	World-writable log file used for symlink attack to target system files (e.g., /etc/passwd or /etc/shadow) via Below preprocessing of logs	CWE-732
record	binary	/usr/bin/below	Below binary exploited with sudo to perform privileged logging operations that can be hijacked via symlinks in /var/log/below	CWE-732
replay	binary	/usr/bin/below	Below binary exploited with sudo to perform privileged logging operations that can be hijacked via symlinks in /var/log/below	CWE-732
snapshot	binary	/usr/bin/below	Below binary exploited with sudo to perform privileged logging operations that can be hijacked via symlinks in /var/log/below	CWE-732
below	path	/var/log/below	Directory created with world-writable permissions enabling symlink attacks in logging path used by Below	CWE-732

17 Jun 2026 09:03Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.8

EPSS0.0036

SSVC

CWE-732