cbl-mariner python-filelock vulnerabilities

Latest cbl-mariner python-filelock CVEs

Newest publication first

1. CVE-2026-22701 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

   Published 2026-01-10

   Medium·CVSS 5.3

   filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race...

2. CVE-2025-68146 filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

   Published 2025-12-16

   Medium·CVSS 6.3

   Impact A Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it wit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.