A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
https://www.cve.org/CVERecord?id=CVE-2025-27591 https://github.com/facebookincubator/below/security/advisories/GHSA-9mc5-7qhg-fp3w
Please log in to add feedback.
This update has been submitted for testing by salimma.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.