CVE-2026-17435: File::Rotate::Simple Privilege Escalation

CVE-2026-17435 Overview

CVE-2026-17435 affects File::Rotate::Simple versions before 0.4.0, a Perl module used for log file rotation. The module creates the target of dangling symbolic links when rotating files with the touch option enabled. When the file to be rotated is a symlink pointing to a missing target, the rotate method skips rotation but still touches the file, creating the target with the permissions of the rotating process.

An attacker able to create a symlink at the log path can leverage this behavior to create arbitrary files with the privileges of the rotation process. This may differ from the process that normally writes to the log, enabling privilege boundary crossing. The touch option is disabled by default, which limits exposure.

Critical Impact
A local attacker with the ability to plant a symbolic link at the rotated file path can create arbitrary files with the permissions of the log-rotating process.

Affected Products

File::Rotate::Simple Perl module versions before 0.4.0
Perl applications and daemons that invoke File::Rotate::Simple with the touch option enabled
CPAN distributions bundling vulnerable File-Rotate-Simple releases

Discovery Timeline

2026-08-07 - CVE-2026-17435 published to NVD and disclosed on the Openwall oss-security mailing list
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17435

Vulnerability Analysis

The flaw is a symbolic link following weakness classified as [CWE-59] (Improper Link Resolution Before File Access). The rotate method in File::Rotate::Simple uses an existence check that resolves through symlinks. When the log file path is a symlink to a non-existent target, the existence check returns false, so the rotation logic treats the file as absent and skips renaming it.

However, when the touch option is enabled, the module unconditionally touches the log path. Touching a dangling symlink creates the target file at the resolved path with the effective user and group of the rotating process. If a privileged process rotates logs written by a less-privileged service, an attacker controlling the symlink source can create files in locations they could not otherwise reach.

Root Cause

The root cause is a mismatch between the presence check and the touch operation. The exists method dereferences symlinks, while touching operates on the resolved path. The pre-patch code guarded rotation with if ($self->file->exists), which returns false for dangling links, causing the module to fall through to touching the target and materializing it on disk.

Attack Vector

Exploitation requires local access and the ability to write a symlink at the log file path before rotation runs. The attacker points the symlink at an attacker-chosen destination not owned by their user. When the rotation process executes with the touch option enabled, it creates the target file with the process's permissions. This can be used to plant files in privileged directories or overwrite ownership expectations for downstream file consumers.

text

[Security]
- If the log file is a dangling link, then it will be rotated without
  touching the destination (CVE-2026-17435).

Source: GitHub patch commit ead3f5c

The code-level fix adds an explicit symlink check using the -l operator so that symlinks are rotated instead of touched:

perl

my $num = $self->start_num;

my $file = $self->_rotated_name( $num );
my $orig = $self->file;
if ( $orig->exists || -l $orig ) {

    $files{ $orig } = {
        current => $orig,
        rotated => $file,
    };

Source: GitHub patch commit ead3f5c in lib/File/Rotate/Simple.pm

Detection Methods for CVE-2026-17435

Indicators of Compromise

Unexpected files appearing at paths owned by the log-rotating process user, especially in system directories.
Symbolic links at configured log paths that resolve to targets outside the log directory.
Rotated log directories containing files whose ownership matches a rotation daemon rather than the original logging service.

Detection Strategies

Inventory Perl applications that depend on File::Rotate::Simple and identify configurations where the touch option is set to true.
Audit filesystem events for symlink(2) and utimensat(2) sequences against log paths writable by unprivileged users.
Compare installed CPAN module versions against 0.4.0 to enumerate vulnerable hosts.

Monitoring Recommendations

Enable Linux audit rules on directories that hold rotated logs to capture symlink creation by non-root users.
Alert when a file is created by a privileged process at a path that was previously a symlink owned by a lower-privileged user.
Track process execution of Perl rotation scripts and correlate with subsequent file-creation events at unusual paths.

How to Mitigate CVE-2026-17435

Immediate Actions Required

Upgrade File::Rotate::Simple to version 0.4.0 or later from MetaCPAN.
Disable the touch option in File::Rotate::Simple configurations until the upgrade is verified.
Ensure log directories are not writable by users who do not own the logging service.

Patch Information

The fix is delivered in File-Rotate-Simplev0.4.0. The patch, referenced by commit ead3f5c0e51217b34d286aa243949dba60b39eba, adds a symlink test so dangling links are rotated rather than materialized on disk. See the GitHub Security Advisory GHSA-fpmm-8f6h-wv74 and the Openwall oss-security disclosure for full advisory content.

Workarounds

Set the touch attribute to false when instantiating File::Rotate::Simple, which prevents the vulnerable code path from executing.
Restrict directory permissions on log paths using the sticky bit and owner-only write access to block symlink planting by other local users.
Run rotation processes with the least privilege necessary so that any file created via the dangling symlink cannot cross a meaningful trust boundary.

bash

# Upgrade the vulnerable Perl module from CPAN
cpanm File::Rotate::Simple@0.4.0

# Harden a log directory against symlink planting
chown root:adm /var/log/myapp
chmod 1750 /var/log/myapp