CVSS 3.1
6.8 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NCVE-2025-27591
Medium (6.8) in facebook below. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in below 0.9.0.
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- facebook:below
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9mc5-7qhg-fp3w | crates.io | below | <0.9.0 | 0.9.0 |
| RUSTSEC-2025-0149 | crates.io | below | >=0.0.0-0 <0.9.0 | 0.9.0 |