CVE-2025-27591

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-275939.3The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code e CVE-2025-275947.5The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device CVE-2025-275959.8The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. T CVE-2025-275978.9Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pol CVE-2025-275987.5ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to ca CVE-2025-275996.5Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locall CVE-2025-27607.8GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary CVE-2025-276006.5FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attack CVE-2025-276014.3Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API man CVE-2025-276026.4Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 a CVE-2025-276039.1XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rig CVE-2025-276047.5XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is publi