CVE-2026-17435
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, the rotate method assumes that the file is absent and does not rotate it, but touches the file, which creates the target. An attacker who can create the symlink can use this to create an arbitrary file with permissions of the process rotating the files.
Risk Assessment
Risk of unauthorized file creation with permissions of the rotating process, potentially leading to privilege escalation or modification of critical files.
Recommendation
Update the File::Rotate::Simple module to version 0.4.0 or later, which includes the fix.
Related vulnerabilities
- CVE-2026-106102Critical
Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.
- CVE-2026-105863Critical
Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- CVE-2026-105859Critical
Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105857Critical
The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105851Critical
Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-104070Critical
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.
- CVE-2026-67273Critical
Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-105845Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-105844Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-67269Critical
Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.
Original NVD description (English source)
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS