CVE-2025-27591

🗓️ 11 Mar 2025 18:29:21Reported by facebookType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 792 Views🌐 WEB

Privileged escalation vulnerability in Below service allows local users to access root privileges.

Reporter	Title	Published	Views	Family All 58
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Aug 202511:54	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	18 Jul 202503:26	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Jul 202522:17	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202604:07	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	2 Jan 202611:20	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	15 Jul 202505:14	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Apr 202601:18	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	16 Jul 202522:31	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	20 Jul 202504:33	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below	19 Nov 202519:56	–	githubexploit

NVD

Vulners

Node

facebook belowRange<0.9.0rust

[
  {
    "defaultStatus": "unaffected",
    "product": "below",
    "vendor": "Meta Platforms, Inc",
    "versions": [
      {
        "lessThan": "0.9.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
facebook	www.facebook.com/security/advisories/cve-2025-27591
openwall	www.openwall.com/lists/oss-security/2025/03/12/1

Parameter	Position	Path	Description	CWE
record	request body	/usr/bin/below record	Local privilege escalation via symlink attack in the 'below' utility. An unprivileged user can create a symlink at /var/log/below/error_root.log pointing to /etc/passwd. When the service is triggered via sudo, it writes to the symlink, allowing the attacker to inject a root user into /etc/passwd.	CWE-732
replay	request body	/usr/bin/below replay	Local privilege escalation via symlink attack in the 'below' utility. An unprivileged user can create a symlink at /var/log/below/error_root.log pointing to /etc/passwd. When the service is triggered via sudo, it writes to the symlink, allowing the attacker to inject a root user into /etc/passwd.	CWE-732
--time	request body	/usr/bin/below replay	Local privilege escalation via symlink attack in the 'below' utility. An unprivileged user can create a symlink at /var/log/below/error_root.log pointing to /etc/passwd. When the service is triggered via sudo, it writes to the symlink, allowing the attacker to inject a root user into /etc/passwd.	CWE-732
snapshot	request body	/usr/bin/below snapshot	Local privilege escalation via symlink attack in the 'below' utility. An unprivileged user can create a symlink at /var/log/below/error_root.log pointing to /etc/passwd. When the service is triggered via sudo, it writes to the symlink, allowing the attacker to inject a root user into /etc/passwd.	CWE-732
--begin	request body	/usr/bin/below snapshot	Local privilege escalation via symlink attack in the 'below' utility. An unprivileged user can create a symlink at /var/log/below/error_root.log pointing to /etc/passwd. When the service is triggered via sudo, it writes to the symlink, allowing the attacker to inject a root user into /etc/passwd.	CWE-732

17 Jun 2026 09:03Current

7High risk

Vulners AI Score7

CVSS 3.16.8

EPSS0.00372

SSVC

CWE-732