CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-27591: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at...
Description
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Classification
CVE ID: CVE-2025-27591
Problem Types
Incorrect Permission Assignment for Critical Resource (CWE-732)Affected Products
Vendor: Meta Platforms, Inc
Product: below
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.02% (probability of being exploited)
EPSS Percentile: 2.43% (scored less or equal to compared to others)
EPSS Date: 2025-04-09 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27591https://www.facebook.com/security/advisories/cve-2025-27591
https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3