CVE-2025-27591
Quick assessment
Affected
Meta Platforms, Inc below
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
below是Meta Incubator开源的一个现代 Linux 系统的资源监视器。 below v0.9.0之前版本存在安全漏洞，该漏洞源于创建了全局可写目录，可能导致通过符号链接攻击提升到root权限。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-27591
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
below 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
below是Meta Incubator开源的一个现代 Linux 系统的资源监视器。 below v0.9.0之前版本存在安全漏洞，该漏洞源于创建了全局可写目录，可能导致通过符号链接攻击提升到root权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Meta Platforms, Inc | below | 0.0.0 ~ 0.9.0 | - |
|
II. Public POCs for CVE-2025-27591
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2025-27591 | https://github.com/obamalaolu/CVE-2025-27591 | POC Details |
| 2 | Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit | https://github.com/rvizx/CVE-2025-27591 | POC Details |
| 3 | CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0 | https://github.com/BridgerAlderson/CVE-2025-27591-PoC | POC Details |
| 4 | CVE-2025-27591 | https://github.com/DarksBlackSk/CVE-2025-27591 | POC Details |
| 5 | CVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0) | https://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591 | POC Details |
| 6 | None | https://github.com/alialucas7/CVE-2025-27591_PoC | POC Details |
| 7 | A Proof of Concept for CVE-2025-27591, a local privilege escalation in Below ≤ v0.8.1 | https://github.com/incommatose/CVE-2025-27591-PoC | POC Details |
| 8 | 🔥 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection | https://github.com/00xCanelo/CVE-2025-27591 | POC Details |
| 9 | None | https://github.com/Thekin-ctrl/CVE-2025-27591-Below | POC Details |
| 10 | a C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root. | https://github.com/Cythonic1/CVE-2025-27591 | POC Details |
| 11 | Below <v0.9.0 PoC Privilege Escalation Exploit | https://github.com/umutcamliyurt/CVE-2025-27591 | POC Details |
| 12 | PoC for CVE-2025-27591 – Local privilege escalation in the below monitoring tool. By symlinking its log file to /etc/passwd, an attacker can inject a root account and gain full system compromise. | https://github.com/danil-koltsov/below-log-race-poc | POC Details |
| 13 | Local Privilege Escalation vai `below` (CVE-2025-27591) - PoC Exploit | https://github.com/HOEUN-Visai/CVE-2025-27591-below- | POC Details |
| 14 | CVE-2025-27591 | https://github.com/krn966/CVE-2025-27591 | POC Details |
| 15 | A Bash-based privilege escalation exploit targeting the `below` system performance monitoring tool. This refurbished exploit leverages a symlink vulnerability in the logging mechanism to inject a root user into `/etc/passwd`, achieving full root access. | https://github.com/0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591 | POC Details |
| 16 | self cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files | https://github.com/0x00Jeff/CVE-2025-27591 | POC Details |
| 17 | Local Privilege Escalation vai `below` (CVE-2025-27591) - PoC Exploit | https://github.com/VisaiCyber/CVE-2025-27591-below- | POC Details |
| 18 | Exploit for CVE-2025-27591 (for educational purposes) | https://github.com/Stp1t/CVE-2025-27591 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-27591
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-27591 (1)
Other References for CVE-2025-27591 (1)
-
https://www.facebook.com/security/advisories/cve-2025-27591 x_refsource_CONFIRM
IV. Related Vulnerabilities
V. Comments for CVE-2025-27591
No comments yet