CVE-2025-27591: Facebook Below

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Affected products

• Facebook Below: before 0.9.0 (fixed in 0.9.0)

Published 2025-03-11. Last modified 2026-06-17.