Security Flaw in File::Rotate::Simple Affects Perl Users

CVE-2026-17435

What is CVE-2026-17435?

The File::Rotate::Simple library for Perl contains a vulnerability that allows an attacker to create arbitrary files with elevated permissions through the exploitation of dangling symbolic links during the file rotation process. When the file chosen for rotation is a symbolic link pointing to a non-existent target, and the touch option is enabled, the rotate method fails to perform the intended rotation due to an incorrect existence check. Instead, it unexpectedly creates the target file with the permissions of the process executing the rotation. Although the touch option is disabled by default, this behavior presents a potential security risk if enabled.

References