Post Syndicated from jzb original https://lwn.net/Articles/1013842/

The SUSE Security Team blog has a post with a
detailed analysis of a vulnerability (CVE-2025-27591)
in the below
tool for recording and displaying system data.

In January 2025, Below was packaged and submitted to openSUSE
Tumbleweed. Below runs as a systemd service with root privileges. The
SUSE security team monitors additions and changes to systemd service
unit files in openSUSE Tumbleweed, and through this we noticed
problematic log directory permissions applied in Below’s code.