A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
PoC: CVE-2025-27591
self cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files
PoC: CVE-2025-27591-below-
Local Privilege Escalation vai `below` (CVE-2025-27591) - PoC Exploit
PoC: below-log-race-poc
PoC for CVE-2025-27591 – Local privilege escalation in the below monitoring tool. By symlinking its log file to /etc/passwd, an attacker can inject a root account and gain full system compromise.
PoC: CVE-2025-27591
a C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root.
PoC: CVE-2025-27591-PoC
🔥 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection
PoC: CVE-2025-27591-PoC
CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0
PoC: CVE-2025-27591-PoC
# CVE-2025-27591 PoC — Below Local Privilege Escalation This repository contains a Proof of Concept (PoC) demonstrating the local privilege escalation vulnerability identified as **CVE-2025-27591** in **Below**, a Linux system observability tool.
PoC: CVE-2025-27591-Meta-below-LPE
CVE-2025-27591 – Meta below symlink following local privilege escalation (HackTheBox CTF)
PoC: CVE-2025-27591
Exploit for CVE-2025-27591 (for educational purposes)
PoC: Below-Logger-Symlink-Attack_CVE-2025-27591
A Bash-based privilege escalation exploit targeting the `below` system performance monitoring tool. This refurbished exploit leverages a symlink vulnerability in the logging mechanism to inject a root user into `/etc/passwd`, achieving full root access.
PoC: CVE-2025-27591
CVE-2025-27591
PoC: CVE-2025-27591
Below <v0.9.0 PoC Privilege Escalation Exploit
PoC: CVE-2025-27591-PoC
A Proof of Concept for CVE-2025-27591, a local privilege escalation in Below ≤ v0.8.1
PoC: Linux-Privilege-Escalation-CVE-2025-27591
CVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0)
PoC: CVE-2025-27591-Proof-Of-Concept
CVE-2025-27591
PoC: CVE-2025-27591
Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit
PoC: CVE-2025-27591
CVE-2025-27591
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free