CVE-2025-27591

🗓️ 11 Mar 2025 18:29:21Reported by facebookType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 240 Views🌐 WEB

Privileged escalation vulnerability in Below service allows local users to access root privileges.

Reporter	Title	Published	Views	Family All 37
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Aug 202511:54	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	18 Jul 202503:26	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Jul 202522:17	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	2 Jan 202611:20	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202505:14	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Apr 202601:18	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Jul 202522:31	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	20 Jul 202504:33	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Nov 202519:56	–	githubexploit
GithubExploit	Exploit for CVE-2025-27519	22 Aug 202508:05	–	githubexploit

NVD

Node

facebook belowRange<0.9.0rust

[
  {
    "defaultStatus": "unaffected",
    "product": "below",
    "vendor": "Meta Platforms, Inc",
    "versions": [
      {
        "lessThan": "0.9.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
facebook	www.facebook.com/security/advisories/cve-2025-27591
github	www.github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
openwall	www.openwall.com/lists/oss-security/2025/03/12/1

Parameter	Position	Path	Description	CWE
malicious_entry	path	/etc/passwd	Target file injected via symlink to gain root privileges	CWE-732
root2:x:0:0:root:/root:/bin/bash	path	/etc/passwd	Target file injected via symlink to gain root privileges	CWE-732
record	binary	/usr/bin/below	Vulnerable binary exploited via sudo to perform insecure logging	CWE-732
snapshot	binary	/usr/bin/below	Vulnerable binary exploited via sudo to perform insecure logging	CWE-732

03 Jul 2025 14:40Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.8

EPSS0.00132

SSVC

CWE-732