PT-2026-2251 · Pypi+3 · Filelock+3

George Tsigourakos + 1 · Published 2026-01-01 · Updated 2026-03-17 · CVE-2026-22701

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions filelock versions prior to 3.20.3

Description A race condition exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a timing issue between permission validation and file creation. This race condition occurs in the acquire() method between raise on not writable file() and os.open(). An attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.

Recommendations Upgrade to filelock version 3.20.3 or later.

Exploit

Fix

DoS

Link Following

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-362

CWE-367

Related Identifiers

AZL-74234

AZL-79235

CVE-2026-22701

GHSA-QMGC-5H2G-MVRW

OESA-2026-1237

OESA-2026-1238

OESA-2026-1239

OESA-2026-1240

OPENSUSE-SU-2026:10043-1

OPENSUSE-SU-2026:20144-1

SUSE-SU-2026:0220-1

SUSE-SU-2026:0335-1

SUSE-SU-2026:20216-1

USN-7999-1

Affected Products

Debian

Linuxmint

Ubuntu

Filelock

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22701.json · Exploit
• https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw · Vendor Advisory
• https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0 · Patch
• https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0335-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22701 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22701 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22701 · Security Note
• https://ubuntu.com/security/CVE-2026-22701 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22701 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22701 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1239 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qmgc-5h2g-mvrw · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68146 · Vendor Advisory