Before version 0.4.0, the File::Rotate::Simple Perl module creates the target of dangling symlinks when rotating log files. If a user can create a symlink pointing to a missing file and the touch option is enabled, the module will touch the filename, causing the filesystem to create the target file with the permissions of the process performing the rotation. This permits an attacker to place arbitrary files—such as scripts or binaries—under a process’s authority, potentially enabling privilege escalation or subsequent exploitation. The vulnerability is a consequence of CWE-59.

The vulnerability affects all installations of the File::Rotate::Simple module by RRWO that are earlier than version 0.4.0. No specific operating systems or Perl versions are singled out, but any environment that runs this module and performs log rotation is potentially exposed.

The exploit requires an attacker who can create symbolic links in the directory that File::Rotate::Simple rotates and who has the ability to enable the touch option, which is disabled by default. The CVSS score of 2.5 indicates low overall severity, and the EPSS score of < 1 % reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Given that the attacker needs local file system write privileges to create the symlink and that enabling touch requires explicit configuration, the likelihood of exploitation remains low to moderate. However, if successful, the malicious file would be created with the privileges of the process performing the rotation, potentially allowing privilege escalation.