tox-dev filelock up to 3.20.0 on Python UnixFileLock/WindowsFileLock os.open toctou

Summaryinfo

A vulnerability, which was classified as problematic, was found in tox-dev filelock up to 3.20.0 on Python. Affected by this issue is the function os.open of the component UnixFileLock/WindowsFileLock. Executing a manipulation can lead to toctou. This vulnerability appears as CVE-2025-68146. The attack requires local access. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in tox-dev filelock up to 3.20.0 on Python. This vulnerability affects the function os.open of the component UnixFileLock/WindowsFileLock. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect integrity, and availability. CVE summarizes:

filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.

The advisory is available at github.com. This vulnerability was named CVE-2025-68146 since 12/15/2025. The exploitation appears to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 282543 (SUSE SLED15 / SLES15 Security Update : python-filelock (SUSE-SU-2026:0082-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.20.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 4724d7f8c3393ec1f048c93933e6e3e6ec321f0e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (282543) and CERT Bund (WID-SEC-2026-1730). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Xerox FreeFlow Print Server

Productinfo

Vendor

• tox-dev

Name

• filelock

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20.0

License

• open-source

Website

• Product: https://github.com/tox-dev/filelock/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion