{"id":"CVE-2026-22701","aliases":["AZL-74234","AZL-79235","DEBIAN-CVE-2026-22701","EUVD-2026-1870","GHSA-qmgc-5h2g-mvrw","OESA-2026-1237","OESA-2026-1238","OESA-2026-1239","OESA-2026-1240","PYSEC-2026-1374","ROOT-APP-PYPI-CVE-2026-22701","SUSE-SU-2026:0220-1","SUSE-SU-2026:0335-1","SUSE-SU-2026:20216-1","UBUNTU-CVE-2026-22701","USN-7999-1","openSUSE-SU-2026:10043-1","openSUSE-SU-2026:20144-1"],"status":"published","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00127,"percentile":0.02351,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-367","CWE-59"],"published":"2026-01-10T05:59:28Z","modified":"2026-11-09T12:49:51Z","fixes":[{"ecosystem":"PyPI","package":"filelock","fixed_in":["3.20.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-filelock","fixed_in":["3.20.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-filelock","fixed_in":["3.9.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-filelock","fixed_in":["3.20.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-filelock","fixed_in":["3.13.1-4.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-filelock","fixed_in":["3.13.1-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-filelock","fixed_in":["3.13.1-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-filelock","fixed_in":["3.13.1-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-filelock","fixed_in":["3.19.1+root.io.1","3.19.1+root.io.2","3.20.0+root.io.1","3.20.0+root.io.2","3.20.2+root.io.1","3.20.2+root.io.2","3.19.1+root.io.3","3.20.0+root.io.3","3.18.0+root.io.1","3.12.2+root.io.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"filelock","fixed_in":["3.20.2+aikido.2","3.19.1+aikido.3","3.20.0+aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"python-filelock","fixed_in":["3.0.12-150100.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-filelock","fixed_in":["3.0.12-150100.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-filelock","fixed_in":["3.0.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-filelock","fixed_in":["3.6.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-filelock","fixed_in":["3.13.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-filelock","fixed_in":["3.20.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.12-13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1+deb12u1"}]}],"versions":["3.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1","3.18.0-1+deb13u1","3.19.1-1","3.20.0-1","3.20.2-1","3.20.3-1","3.24.3-1","3.25.0-1","3.25.2-1","3.29.0-1","3.29.4-1","3.29.5-1","3.29.7-1","3.32.0-1","3.32.2-1","3.32.4-1","3.32.4-2","3.32.5-1","3.32.6-1","4.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-1"}]}],"versions":["3.18.0-1","3.19.1-1","3.20.0-1","3.20.2-1"]},{"source":"osv","ecosystem":"PyPI","package":"filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","1.0.0","1.0.1","1.0.2","1.0.3","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","3.0.0","3.0.10","3.0.12","3.0.2","3.0.3","3.0.4","3.0.6","3.0.8","3.0.9","3.1.0","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.11.0","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.17.0","3.18.0","3.19.1","3.2.0","3.2.1","3.20.0","3.20.1","3.20.2","3.3.0","3.3.1","3.3.2","3.4.0","3.4.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-4.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","1.0.0","1.0.1","1.0.2","1.0.3","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","3.0.0","3.0.10","3.0.12","3.0.2","3.0.3","3.0.4","3.0.6","3.0.8","3.0.9","3.1.0","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.11.0","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.17.0","3.18.0","3.19.1","3.2.0","3.2.1","3.20.0","3.20.1","3.20.2","3.3.0","3.3.1","3.3.2","3.4.0","3.4.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1+root.io.1"},{"fixed":"3.19.1+root.io.2"},{"fixed":"3.20.0+root.io.1"},{"fixed":"3.20.0+root.io.2"},{"fixed":"3.20.2+root.io.1"},{"fixed":"3.20.2+root.io.2"},{"fixed":"3.19.1+root.io.3"},{"fixed":"3.20.0+root.io.3"},{"fixed":"3.18.0+root.io.1"},{"fixed":"3.12.2+root.io.1"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2+aikido.2"},{"fixed":"3.19.1+aikido.3"},{"fixed":"3.20.0+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.2-150400.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.2-150400.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-150100.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-150100.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1ubuntu0.1~esm1"}]}],"versions":["2.0.11-1","2.0.12-1","2.0.13-1","3.0.0-2","3.0.3-1","3.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu0.1~esm1"}]}],"versions":["3.0.12-2","3.3.2-1","3.4.0-1","3.4.2-1","3.4.2-2","3.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-1ubuntu0.1~esm1"}]}],"versions":["3.12.2-1","3.12.4-1","3.13.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.3-1","3.29.4-1","3.32.0-1","3.32.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1ubuntu0.1~esm1"}]}],"versions":["2.0.11-1","2.0.12-1","2.0.13-1","3.0.0-2","3.0.3-1","3.0.4-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-2ubuntu0.1~esm1"}]}],"versions":["3.0.12-1","3.0.12-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu0.1~esm1"}]}],"versions":["3.0.12-2","3.3.2-1","3.4.0-1","3.4.2-1","3.4.2-2","3.6.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-1ubuntu0.1~esm1"}]}],"versions":["3.12.2-1","3.12.4-1","3.13.1-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-filelock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"tox-dev","product":"filelock"}],"references":[{"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qmgc-5h2g-mvrw","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22701.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22701","tags":["advisory"]},{"url":"https://github.com/tox-dev/filelock","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1237","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1238","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1239","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1240","tags":["advisory"]},{"url":"https://pypi.org/project/filelock","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260220-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255244","tags":["report"]},{"url":"https://bugzilla.suse.com/1256457","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22701","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260335-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620216-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22701","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7999-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68146","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-22701","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T05:59:28.872Z","modified":"2026-01-12T16:45:50.638Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-59","CWE-362","CWE-367"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-1870","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T05:59:28Z","modified":"2026-01-12T16:45:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-qmgc-5h2g-mvrw","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"## Vulnerability Summary\n\n**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock\n\n**Affected Component:** `filelock` package - `SoftFileLock` class\n**File:** `src/filelock/_soft.py` lines 17-27\n**CWE:** CWE-362, CWE-367, CWE-59\n\n---\n\n## Description\n\nA TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.\n\nThe vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.\n\n### Attack Scenario\n\n```\n1. Lock attempts to acquire on /tmp/app.lock\n2. Permission validation passes\n3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock\n4. os.open() tries to create lock file\n5. Lock operates on attacker-controlled target file or fails\n```\n\n---\n\n## Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.\n\n**Affected Users:**\n- Applications using `filelock.SoftFileLock` directly\n- Applications using the fallback `FileLock` on systems without `fcntl` support (e.g., GraalPy)\n\n**Consequences:**\n- **Silent lock acquisition failure** - applications may not detect that exclusive resource access is not guaranteed\n- **Denial of Service** - attacker can prevent lock file creation by maintaining symlink\n- **Resource serialization failures** - multiple processes may acquire \"locks\" simultaneously\n- **Unintended file operations** - lock could operate on attacker-controlled files\n\n**CVSS v4.0 Score:** 5.6 (Medium)\n**Vector:** CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n\n**Attack Requirements:**\n- Local filesystem access to the directory containing lock files\n- Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)\n- Ability to time the symlink creation during the narrow race window\n\n---\n\n## Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, the vulnerability has been patched by adding the `O_NOFOLLOW` flag to prevent symlink following during lock file creation.\n\n**Patched Version:** Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)\n\n**Mitigation Details:**\n- The `O_NOFOLLOW` flag is added conditionally and gracefully degrades on platforms without support\n- On platforms with `O_NOFOLLOW` support (most modern systems): symlink attacks are completely prevented\n- On platforms without `O_NOFOLLOW` (e.g., GraalPy): TOCTOU window remains but is documented\n\n**Users should:**\n- Upgrade to the patched version when available\n- For critical deployments, consider using `UnixFileLock` or `WindowsFileLock` instead of the fallback `SoftFileLock`\n\n---\n\n## Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nFor users unable to update immediately:\n\n1. **Avoid `SoftFileLock` in security-sensitive contexts** - use `UnixFileLock` or `WindowsFileLock` when available (these were already patched for CVE-2025-68146)\n\n2. **Restrict filesystem permissions** - prevent untrusted users from creating symlinks in lock file directories:\n   ```bash\n   chmod 700 /path/to/lock/directory\n   ```\n\n3. **Use process isolation** - isolate untrusted code from lock file paths to prevent symlink creation\n\n4. **Monitor lock operations** - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations\n\n---\n\n## References\n\n_Are there any links users can visit to find out more?_\n\n- **Similar Vulnerability:** CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)\n- **CWE-362 (Concurrent Execution using Shared Resource):** https://cwe.mitre.org/data/definitions/362.html\n- **CWE-367 (Time-of-check Time-of-use Race Condition):** https://cwe.mitre.org/data/definitions/367.html\n- **CWE-59 (Improper Link Resolution Before File Access):** https://cwe.mitre.org/data/definitions/59.html\n- **O_NOFOLLOW documentation:** https://man7.org/linux/man-pages/man2/open.2.html\n- **GitHub Repository:** https://github.com/tox-dev/filelock\n\n---\n\n**Reported by:** George Tsigourakos (@tsigouris007)","status":"published","published":"2026-01-13T18:44:55Z","modified":"2026-01-13T18:44:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-59","CWE-362","CWE-367"],"updated_at":"2026-11-02T14:39:17.333958Z"}],"nvd":[{"id":"CVE-2026-22701","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T06:15:52.673Z","modified":"2026-06-17T10:20:15.667Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-59","CWE-362","CWE-367"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"CVE-2026-22701","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T05:59:28.872Z","modified":"2026-10-28T02:59:42.474908775Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-362","CWE-367","CWE-59"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-22701","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T06:15:52.673Z","modified":"2026-10-01T03:03:21.108969605Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-qmgc-5h2g-mvrw","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"## Vulnerability Summary\n\n**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock\n\n**Affected Component:** `filelock` package - `SoftFileLock` class\n**File:** `src/filelock/_soft.py` lines 17-27\n**CWE:** CWE-362, CWE-367, CWE-59\n\n---\n\n## Description\n\nA TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.\n\nThe vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.\n\n### Attack Scenario\n\n```\n1. Lock attempts to acquire on /tmp/app.lock\n2. Permission validation passes\n3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock\n4. os.open() tries to create lock file\n5. Lock operates on attacker-controlled target file or fails\n```\n\n---\n\n## Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.\n\n**Affected Users:**\n- Applications using `filelock.SoftFileLock` directly\n- Applications using the fallback `FileLock` on systems without `fcntl` support (e.g., GraalPy)\n\n**Consequences:**\n- **Silent lock acquisition failure** - applications may not detect that exclusive resource access is not guaranteed\n- **Denial of Service** - attacker can prevent lock file creation by maintaining symlink\n- **Resource serialization failures** - multiple processes may acquire \"locks\" simultaneously\n- **Unintended file operations** - lock could operate on attacker-controlled files\n\n**CVSS v4.0 Score:** 5.6 (Medium)\n**Vector:** CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n\n**Attack Requirements:**\n- Local filesystem access to the directory containing lock files\n- Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)\n- Ability to time the symlink creation during the narrow race window\n\n---\n\n## Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, the vulnerability has been patched by adding the `O_NOFOLLOW` flag to prevent symlink following during lock file creation.\n\n**Patched Version:** Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)\n\n**Mitigation Details:**\n- The `O_NOFOLLOW` flag is added conditionally and gracefully degrades on platforms without support\n- On platforms with `O_NOFOLLOW` support (most modern systems): symlink attacks are completely prevented\n- On platforms without `O_NOFOLLOW` (e.g., GraalPy): TOCTOU window remains but is documented\n\n**Users should:**\n- Upgrade to the patched version when available\n- For critical deployments, consider using `UnixFileLock` or `WindowsFileLock` instead of the fallback `SoftFileLock`\n\n---\n\n## Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nFor users unable to update immediately:\n\n1. **Avoid `SoftFileLock` in security-sensitive contexts** - use `UnixFileLock` or `WindowsFileLock` when available (these were already patched for CVE-2025-68146)\n\n2. **Restrict filesystem permissions** - prevent untrusted users from creating symlinks in lock file directories:\n   ```bash\n   chmod 700 /path/to/lock/directory\n   ```\n\n3. **Use process isolation** - isolate untrusted code from lock file paths to prevent symlink creation\n\n4. **Monitor lock operations** - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations\n\n---\n\n## References\n\n_Are there any links users can visit to find out more?_\n\n- **Similar Vulnerability:** CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)\n- **CWE-362 (Concurrent Execution using Shared Resource):** https://cwe.mitre.org/data/definitions/362.html\n- **CWE-367 (Time-of-check Time-of-use Race Condition):** https://cwe.mitre.org/data/definitions/367.html\n- **CWE-59 (Improper Link Resolution Before File Access):** https://cwe.mitre.org/data/definitions/59.html\n- **O_NOFOLLOW documentation:** https://man7.org/linux/man-pages/man2/open.2.html\n- **GitHub Repository:** https://github.com/tox-dev/filelock\n\n---\n\n**Reported by:** George Tsigourakos (@tsigouris007)","status":"published","published":"2026-01-13T18:44:55Z","modified":"2026-09-10T03:50:33.702580779Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-362","CWE-367","CWE-59"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"OESA-2026-1237","title":"python-filelock security update","description":"This package contains a single module, which implements a platform independent file locking mechanism for Python.\r\n\r\nSecurity Fix(es):\n\nfilelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)","status":"published","published":"2026-01-23T11:10:16Z","modified":"2026-08-18T01:19:30.003737387Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1238","title":"python-filelock security update","description":"This package contains a single module, which implements a platform independent file locking mechanism for Python.\r\n\r\nSecurity Fix(es):\n\nfilelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)","status":"published","published":"2026-01-23T11:10:16Z","modified":"2026-08-18T01:19:30.070565806Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1239","title":"python-filelock security update","description":"This package contains a single module, which implements a platform independent file locking mechanism for Python.\r\n\r\nSecurity Fix(es):\n\nfilelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)","status":"published","published":"2026-01-23T11:10:16Z","modified":"2026-08-18T01:19:30.057652964Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1240","title":"python-filelock security update","description":"This package contains a single module, which implements a platform independent file locking mechanism for Python.\r\n\r\nSecurity Fix(es):\n\nfilelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)","status":"published","published":"2026-01-23T11:10:16Z","modified":"2026-08-18T01:19:30.150126511Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"PYSEC-2026-1374","title":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","description":"## Vulnerability Summary\n\n**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock\n\n**Affected Component:** `filelock` package - `SoftFileLock` class\n**File:** `src/filelock/_soft.py` lines 17-27\n**CWE:** CWE-362, CWE-367, CWE-59\n\n---\n\n## Description\n\nA TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.\n\nThe vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.\n\n### Attack Scenario\n\n```\n1. Lock attempts to acquire on /tmp/app.lock\n2. Permission validation passes\n3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock\n4. os.open() tries to create lock file\n5. Lock operates on attacker-controlled target file or fails\n```\n\n---\n\n## Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.\n\n**Affected Users:**\n- Applications using `filelock.SoftFileLock` directly\n- Applications using the fallback `FileLock` on systems without `fcntl` support (e.g., GraalPy)\n\n**Consequences:**\n- **Silent lock acquisition failure** - applications may not detect that exclusive resource access is not guaranteed\n- **Denial of Service** - attacker can prevent lock file creation by maintaining symlink\n- **Resource serialization failures** - multiple processes may acquire \"locks\" simultaneously\n- **Unintended file operations** - lock could operate on attacker-controlled files\n\n**CVSS v4.0 Score:** 5.6 (Medium)\n**Vector:** CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n\n**Attack Requirements:**\n- Local filesystem access to the directory containing lock files\n- Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)\n- Ability to time the symlink creation during the narrow race window\n\n---\n\n## Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, the vulnerability has been patched by adding the `O_NOFOLLOW` flag to prevent symlink following during lock file creation.\n\n**Patched Version:** Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)\n\n**Mitigation Details:**\n- The `O_NOFOLLOW` flag is added conditionally and gracefully degrades on platforms without support\n- On platforms with `O_NOFOLLOW` support (most modern systems): symlink attacks are completely prevented\n- On platforms without `O_NOFOLLOW` (e.g., GraalPy): TOCTOU window remains but is documented\n\n**Users should:**\n- Upgrade to the patched version when available\n- For critical deployments, consider using `UnixFileLock` or `WindowsFileLock` instead of the fallback `SoftFileLock`\n\n---\n\n## Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nFor users unable to update immediately:\n\n1. **Avoid `SoftFileLock` in security-sensitive contexts** - use `UnixFileLock` or `WindowsFileLock` when available (these were already patched for CVE-2025-68146)\n\n2. **Restrict filesystem permissions** - prevent untrusted users from creating symlinks in lock file directories:\n   ```bash\n   chmod 700 /path/to/lock/directory\n   ```\n\n3. **Use process isolation** - isolate untrusted code from lock file paths to prevent symlink creation\n\n4. **Monitor lock operations** - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations\n\n---\n\n## References\n\n_Are there any links users can visit to find out more?_\n\n- **Similar Vulnerability:** CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)\n- **CWE-362 (Concurrent Execution using Shared Resource):** https://cwe.mitre.org/data/definitions/362.html\n- **CWE-367 (Time-of-check Time-of-use Race Condition):** https://cwe.mitre.org/data/definitions/367.html\n- **CWE-59 (Improper Link Resolution Before File Access):** https://cwe.mitre.org/data/definitions/59.html\n- **O_NOFOLLOW documentation:** https://man7.org/linux/man-pages/man2/open.2.html\n- **GitHub Repository:** https://github.com/tox-dev/filelock\n\n---\n\n**Reported by:** George Tsigourakos (@tsigouris007)","status":"published","published":"2026-07-07T16:03:18.208767Z","modified":"2026-07-07T17:47:14.84824867Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"ROOT-APP-PYPI-CVE-2026-22701","title":"CVE-2026-22701 in rootio-filelock - Patched by Root","description":"Root has patched CVE-2026-22701 in the rootio-filelock package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-14T15:48:03Z","modified":"2026-07-14T19:17:01.808639037Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2026-22701","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T06:15:00Z","modified":"2026-11-09T12:49:51.941462645Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"AZL-74234","title":"CVE-2026-22701 affecting package python-filelock for versions less than 3.20.3-1","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T06:15:52Z","modified":"2026-04-21T04:52:45.641052Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-79235","title":"CVE-2026-22701 affecting package python-filelock 3.0.12-13","description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","status":"published","published":"2026-01-10T06:15:52Z","modified":"2026-04-21T04:34:39.548081Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"openSUSE-SU-2026:10043-1","title":"python311-filelock-3.20.3-1.1 on GA media","description":"These are all security issues fixed in the python311-filelock-3.20.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-13T00:00:00Z","modified":"2026-03-23T04:54:23.660758Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20144-1","title":"Security update for python-filelock","description":"This update for python-filelock fixes the following issues:\n\n- CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files (bsc#1255244).\n- CVE-2026-22701: TOCTOU race condition in the SoftFileLock implementation (bsc#1256457).\n","status":"published","published":"2026-01-30T21:24:37Z","modified":"2026-03-23T04:54:45.98418Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0220-1","title":"Security update for python-filelock","description":"This update for python-filelock fixes the following issues:\n\n- CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files (bsc#1255244).\n- CVE-2026-22701: TOCTOU race condition in the SoftFileLock implementation (bsc#1256457).\n","status":"published","published":"2026-01-22T12:15:26Z","modified":"2026-03-23T04:52:01.684417Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0335-1","title":"Security update for python-filelock","description":"This update for python-filelock fixes the following issues:\n\n- CVE-2026-22701: Fixed TOCTOU race condition in SoftFileLock implementation \n  of he filelock package (bsc#1256457)\n","status":"published","published":"2026-01-29T10:15:42Z","modified":"2026-03-23T04:52:08.878242Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20216-1","title":"Security update for python-filelock","description":"This update for python-filelock fixes the following issues:\n\n- CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files (bsc#1255244).\n- CVE-2026-22701: TOCTOU race condition in the SoftFileLock implementation (bsc#1256457).\n","status":"published","published":"2026-01-30T21:26:21Z","modified":"2026-03-23T04:52:45.184896Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-7999-1","title":"python-filelock vulnerabilities","description":"It was discovered that Filelock incorrectly handled symlinks in temp files.\nA local attacker could possibly use this issue to cause lock operations to\nfail or behave unexpectedly. (CVE-2026-22701)\n\nIt was discovered that the file locking implementation in the Filelock\npackage contained a race condition. A local attacker could possibly use\nthis to cause a denial of service or corrupt arbitrary user files.\n(CVE-2025-68146)","status":"published","published":"2026-02-02T20:26:28Z","modified":"2026-04-27T18:34:35.689086Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}