CVE-2025-27591: Below: World Writable Dictory in /var/log/below Allows Local Privilege Escalation (CVE-2025-27591)
Impact A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Patches https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83
This is included in version 0.9.0
Workarounds Change the permission on /var/log/below manually
References https://www.facebook.com/security/advisories/cve-2025-27591 https://www.cve.org/CVERecord?id=CVE-2025-27591
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/belowto a version that resolves this vulnerability.Fixed in 0.9.0 - Upgrade
Upgrade
Belowto a version that resolves this vulnerability.Fixed in 0.9.0Patch CVE-2025-27591 - Configuration
Manually change permissions on `/var/log/below` to remove world-writable access (the issue is a world-writable directory at `/var/log/below` that allowed symlink attacks against files such as `/etc/shadow`).
Below (log directory permissions) /var/log/below permissions = not world-writable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27591?
CVE-2025-27591 is classified as a medium severity privilege escalation vulnerability.
How do I fix CVE-2025-27591?
To fix CVE-2025-27591, upgrade Below to version 0.9.0 or later where the vulnerability has been resolved.
Who is affected by CVE-2025-27591?
CVE-2025-27591 affects users of Below versions prior to 0.9.0.
What type of attack does CVE-2025-27591 allow?
CVE-2025-27591 allows local unprivileged users to perform symlink attacks that could escalate privileges to root.
Where is the vulnerability located in CVE-2025-27591?
The vulnerability in CVE-2025-27591 is located in a world-writable directory created at /var/log/below.