CVE-2026-17435: CWE-59 Improper Link Resolution Before File Access ('Link Following') in RRWO File::Rotate::Simple
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.
AI Analysis
Technical Summary
The vulnerability in File::Rotate::Simple (prior to version 0.4.0) involves improper link resolution before file access (CWE-59). When rotating files, if the file is a symbolic link to a non-existent target and the 'touch' option is enabled, the rotate method assumes the file is absent and does not rotate it but proceeds to touch the file, thereby creating the target file. This behavior can be exploited by an attacker with the ability to create symlinks to create arbitrary files with the permissions of the process performing the rotation, which may differ from the original log file writer's permissions. The 'touch' option is disabled by default, reducing the likelihood of exploitation.
Potential Impact
An attacker with the ability to create symbolic links can leverage this vulnerability to create arbitrary files with the permissions of the process that performs the file rotation. This could lead to unauthorized file creation or modification, potentially impacting system integrity. However, the impact is limited by the requirement that the attacker can create symlinks and that the 'touch' option is enabled, which is not the default setting.
Mitigation Recommendations
No official fix or patch is currently documented. Since the vulnerability requires the 'touch' option to be enabled (which is disabled by default), the immediate mitigation is to ensure that the 'touch' option remains disabled unless absolutely necessary. Monitor vendor advisories for any future patches or updates addressing this issue.
CVE-2026-17435: CWE-59 Improper Link Resolution Before File Access ('Link Following') in RRWO File::Rotate::Simple
Description
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.
CVSS v3.1
Score 2.5low
Affected software
RRWO
File::Rotate::Simple
pkg:github/File-Rotate-SimpleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in File::Rotate::Simple (prior to version 0.4.0) involves improper link resolution before file access (CWE-59). When rotating files, if the file is a symbolic link to a non-existent target and the 'touch' option is enabled, the rotate method assumes the file is absent and does not rotate it but proceeds to touch the file, thereby creating the target file. This behavior can be exploited by an attacker with the ability to create symlinks to create arbitrary files with the permissions of the process performing the rotation, which may differ from the original log file writer's permissions. The 'touch' option is disabled by default, reducing the likelihood of exploitation.
Potential Impact
An attacker with the ability to create symbolic links can leverage this vulnerability to create arbitrary files with the permissions of the process that performs the file rotation. This could lead to unauthorized file creation or modification, potentially impacting system integrity. However, the impact is limited by the requirement that the attacker can create symlinks and that the 'touch' option is enabled, which is not the default setting.
Mitigation Recommendations
No official fix or patch is currently documented. Since the vulnerability requires the 'touch' option to be enabled (which is disabled by default), the immediate mitigation is to ensure that the 'touch' option remains disabled unless absolutely necessary. Monitor vendor advisories for any future patches or updates addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-25T12:35:32.249Z
- State
- PUBLISHED
Threat ID: 6a764da6bf8831d5392fda8f
Added to database: 08/07/2026, 21:27:02 UTC
Last enriched: 08/15/2026, 14:58:21 UTC
Last updated: 09/22/2026, 01:52:42 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.