CVE-2025-27591 is a medium-severity (CVSS 6.8) CWE-732 vulnerability in below. 7 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for below — see the affected versions and patch details below.
Below has Incorrect Permission Assignment for Critical Resource
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-27591.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
belowReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Patches
https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83
This is included in version 0.9.0
Workarounds
Change the permission on /var/log/below manually
References
https://www.facebook.com/security/advisories/cve-2025-27591 https://www.cve.org/CVERecord?id=CVE-2025-27591
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | below | all versions | 0.9.0cargo update -p below --precise 0.9.0 |
Affected Products
belowfacebookResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
BridgerAlderson/CVE-2025-27591-PoC
CVE-2025-27591 is a privilege escalation vulnerability that affected the
0x00Jeff/CVE-2025-27591
self cleaning CVE-2025-27591 Poc that grants a root reverse shell instea
obamalaolu/CVE-2025-27591
CVE-2025-27591
dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591
CVE-2025-27591 is a known privilege escalation vulnerability in the Belo
incommatose/CVE-2025-27591-PoC
A Proof of Concept for CVE-2025-27591, a local privilege escalation in B
rvzsec/CVE-2025-27591
Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit
Cythonic1/CVE-2025-27591
a C exploit for CVE-2025-27591, which allow an attacker to escalate priv
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for below, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update below to 0.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-27591 is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is CVE-2025-27591 in your dependencies?
Find it across crates.io, including transitive dependencies.