PT-2025-10891 · Below · Below

Matthias Gerstner · CVE-2025-27591 · Published 2025-01-20 · Updated 2026-02-16

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Below versions prior to 0.9.0

Description A flaw exists in the Below service that allows for privilege escalation. This is due to the creation of a world-writable directory located at /var/log/below. Local, unprivileged users could exploit this by using symlink attacks to manipulate critical system files, such as /etc/shadow, and gain root privileges. The vulnerability is related to incorrect permission assignments for a critical resource.

Recommendations Versions prior to 0.9.0 should be updated to version 0.9.0 or later.

Exploit

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-13248

CVE-2025-27591

GHSA-9MC5-7QHG-FP3W

OPENSUSE-SU-2026:10194-1

RUSTSEC-2025-0149

Affected Products

Below

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27591.json · Exploit
• 🔥 http://openwall.com/lists/oss-security/2025/03/12/1 · Exploit
• https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3 · Patch
• https://osv.dev/vulnerability/RUSTSEC-2025-0149 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13248 · Security Note
• https://osv.dev/vulnerability/GHSA-9mc5-7qhg-fp3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27591 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10194-1 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2025-27591 · Vendor Advisory
• https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83 · Note
• https://github.com/facebookincubator/below/security/advisories/GHSA-9mc5-7qhg-fp3w · Note
• https://github.com/facebookincubator/below · Note
• https://twitter.com/NGLoiVN/status/2023323181206122617 · Twitter Post
• https://t.me/pentestingnews/58029 · Telegram Post