EUVD-2026-54602Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Local access required to place symlink (AV:L); non-default touch configuration plus timing dependency raises complexity (AC:H); low privilege suffices for directory writes (PR:L); impact limited to file creation with no content control (I:L).
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
5DescriptionCVE.org
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files.
When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target.
An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated).
Note that the touch option is disabled by default.
AnalysisAI
Symlink following in File::Rotate::Simple before v0.4.0 allows a local low-privileged attacker to create arbitrary files with the permissions of the log-rotating process. When the non-default touch option is enabled and the log file path is a dangling symlink, the rotate method skips rotation (because the symlink target does not exist) but still invokes touch, which resolves the symlink and materializes the target at an attacker-controlled path. No public exploit code exists and EPSS is 0.17% (7th percentile), indicating negligible current exploitation interest.
Technical ContextAI
File::Rotate::Simple is a Perl CPAN module (RRWO/File-Rotate-Simple) that provides log file rotation functionality. The root cause is CWE-59 (Improper Link Resolution Before File Access - 'Link Following'). The vulnerable logic in _build_files_to_rotate called $self->file->exists to decide whether to rotate the file; because this check follows symlinks, a dangling symlink (one whose target does not exist) returns false - as if no file is present. When the touch => 1 option is set, the rotate method then calls touch on the symlink path to ensure a fresh log file exists, which causes the OS to create the symlink's target rather than the symlink itself. The fix (commit ead3f5c) changes the condition to $orig->exists || -l $orig, detecting dangling symlinks explicitly so that they are rotated rather than having their target created. All releases in the range 0 - <0.4.0 are affected per EUVD-2026-54602.
RemediationAI
Upgrade to File::Rotate::Simple v0.4.0 or later, available on CPAN; the changelog is at https://metacpan.org/release/RRWO/File-Rotate-Simple-v0.4.0/changes and the GitHub security advisory is at https://github.com/robrwo/File-Rotate-Simple/security/advisories/GHSA-fpmm-8f6h-wv74. If an immediate upgrade is not possible, the most effective compensating control is to ensure touch => 0 (or simply omit the option, as it is disabled by default), which eliminates the vulnerable code path entirely with no meaningful operational side effect since touch is non-default. Additionally, ensure that log file directories are not writable by unprivileged users - this prevents attackers from placing symlinks at the log path in the first place. Restricting directory write permissions to the rotating process's effective user only addresses the prerequisite for exploitation without requiring a code change.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today