Description
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Meta Platforms | below | 0.0.0 – < 0.9.0 | 0.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cargo-audit-advisory-db | 20260213-1.1 | openSUSE-SU-2026:10194-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 19 repositories · most starred shown
-
BridgerAlderson/CVE-2025-27591-PoC ★ 33 · Jul 13, 2025
CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0
-
0x00Jeff/CVE-2025-27591 ★ 15 · Nov 19, 2025
self cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files
-
obamalaolu/CVE-2025-27591 ★ 13 · Jul 12, 2025
CVE-2025-27591
-
dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591 ★ 7 · Jul 15, 2025
CVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0)
-
incommatose/CVE-2025-27591-PoC ★ 5 · Jul 18, 2025
A Proof of Concept for CVE-2025-27591, a local privilege escalation in Below < v0.9.0
-
Cythonic1/CVE-2025-27591 ★ 3 · Jul 31, 2025
a C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root.
-
rvzsec/CVE-2025-27591 ★ 3 · Jul 12, 2025
Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit
-
0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591 ★ 2 · Nov 13, 2025
A Bash-based privilege escalation exploit targeting the `below` system performance monitoring tool. This refurbished exploit leverages a symlink vulnerability in the logging mechanism to inject a roo…
-
VisaiCyber/CVE-2025-27591-below- ★ 2 · Sep 3, 2025
Local Privilege Escalation vai `below` (CVE-2025-27591) - PoC Exploit
-
00xCanelo/CVE-2025-27591 ★ 2 · Jul 19, 2025
🔥 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | below | < 0.9.0 | 0.9.0 | GHSA-9mc5-7qhg-fp3w |
| crates.io | below | >= 0.0.0-0, < 0.9.0 | 0.9.0 | RUSTSEC-2025-0149 |
Advisories 1
- openSUSE-SU-2026:10194-1 cargo-audit-advisory-db-20260213-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026