CVE-2025-27591

🗓️ 11 Mar 2025 18:29:21Reported by facebookType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 727 Views🌐 WEB

Privileged escalation vulnerability in Below service allows local users to access root privileges.

Reporter	Title	Published	Views	Family All 39
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Aug 202511:54	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	18 Jul 202503:26	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Jul 202522:17	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202604:07	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	2 Jan 202611:20	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202505:14	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Apr 202601:18	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Jul 202522:31	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	20 Jul 202504:33	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Nov 202519:56	–	githubexploit

NVD

Node

facebook belowRange<0.9.0rust

[
  {
    "defaultStatus": "unaffected",
    "product": "below",
    "vendor": "Meta Platforms, Inc",
    "versions": [
      {
        "lessThan": "0.9.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
facebook	www.facebook.com/security/advisories/cve-2025-27591
github	www.github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
openwall	www.openwall.com/lists/oss-security/2025/03/12/1

Parameter	Position	Path	Description	CWE
record	binary	/usr/bin/below	World-writable log directory /var/log/below enables symlink attacks via Below, allowing manipulation of log targets (e.g., /etc/passwd or /etc/shadow) when executed with elevated privileges (via sudo). PoC references running below with commands like sudo below record.	CWE-732

17 Jun 2026 09:03Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.8

EPSS0.0036

SSVC

CWE-732