CVE-2026-17435

Name of the Vulnerable Software and Affected Versions File::Rotate::Simple versions prior to 0.4.0

Description When the touch option is enabled, the rotate() function fails to correctly handle symbolic links pointing to missing files. Because the existence check is performed against the target of the link rather than the link itself, the software assumes the file is absent and skips rotation. However, it still executes a touch operation, which creates the target file. An attacker capable of creating a symlink can exploit this behavior to create arbitrary files using the permissions of the process performing the rotation.

Recommendations Update File::Rotate::Simple to version 0.4.0 or later. Disable the touch option to prevent the creation of targets from dangling symlinks.