PT-2025-51773 · Filelock+4 · Filelock+4
Published
2025-12-16
·
Updated
2026-06-03
·
CVE-2025-68146
CVSS v3.1
6.5
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
filelock versions prior to 3.20.1
Description
filelock is a platform-independent file lock for Python. A Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The issue exists in file lock creation where the software checks for file existence before opening it with O TRUNC. An attacker can create a symlink pointing to a victim file between the check and open, causing the system to follow the symlink and truncate the target file. This affects users on Unix, Linux, macOS, and Windows systems. The attack requires local filesystem access and the ability to create symlinks. Exploitation can succeed within 1-3 attempts when lock file paths are predictable.
Recommendations
Upgrade to version 3.20.1.
If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock.
Ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks.
Monitor lock file directories for suspicious symlinks before running trusted applications.
Exploit
Fix
DoS
Race Condition
Link Following
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Red Os
Ubuntu
Filelock