CVE-2026-17435
Received Received - Intake

Symlink Creation via Missing Target in File::Rotate::Simple

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: CPANSec

Description
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-17435
EUVD
EUVD-2026-54602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
robrwo file_rotate_simple to 0.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the File::Rotate::Simple Perl module before version 0.4.0. When rotating a log file that is a dangling symbolic link (a link pointing to a non-existent file), the module incorrectly checks for file existence against the target rather than the link itself. If the touch option is enabled, it creates the target file instead of rotating the original, potentially allowing an attacker to create arbitrary files with the permissions of the rotating process.

Detection Guidance

Check if File::Rotate::Simple versions before 0.4.0 are installed using: perl -MFile::Rotate::Simple -e 'print $File::Rotate::Simple::VERSION'

Inspect Perl scripts using File::Rotate::Simple for log rotation with touch option enabled.

Look for dangling symlinks in log directories that could be exploited.

Impact Analysis

An attacker with the ability to create symlinks could exploit this to write files with the permissions of the process performing the log rotation. This could lead to unauthorized file creation, potential privilege escalation, or disruption of log management if critical files are overwritten or created maliciously.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized file creation or modification, potentially violating integrity and access control requirements in GDPR (data integrity) and HIPAA (audit log integrity). If logs are manipulated or compromised, it may affect evidence for compliance audits or breach investigations.

Mitigation Strategies

Upgrade File::Rotate::Simple to version 0.4.0 or later immediately.

Disable the touch option in log rotation configurations if not required.

Review and remove any dangling symlinks in log directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart