CVE-2026-22701

Vulnerability Summary

Title: Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

Affected Component: filelock package - SoftFileLock class
File: src/filelock/_soft.py lines 17-27
CWE: CWE-362, CWE-367, CWE-59

Description

A TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.

The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.

Attack Scenario

1. Lock attempts to acquire on /tmp/app.lock
2. Permission validation passes
3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock
4. os.open() tries to create lock file
5. Lock operates on attacker-controlled target file or fails

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

For users unable to update immediately:

1. Avoid SoftFileLock in security-sensitive contexts - use UnixFileLock or WindowsFileLock when available (these were already patched for CVE-2025-68146)

2. Restrict filesystem permissions - prevent untrusted users from creating symlinks in lock file directories:

   chmod 700 /path/to/lock/directory
   

3. Use process isolation - isolate untrusted code from lock file paths to prevent symlink creation

4. Monitor lock operations - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations

References

Are there any links users can visit to find out more?

• Similar Vulnerability: CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)
• CWE-362 (Concurrent Execution using Shared Resource): https://cwe.mitre.org/data/definitions/362.html
• CWE-367 (Time-of-check Time-of-use Race Condition): https://cwe.mitre.org/data/definitions/367.html
• CWE-59 (Improper Link Resolution Before File Access): https://cwe.mitre.org/data/definitions/59.html
• O_NOFOLLOW documentation: https://man7.org/linux/man-pages/man2/open.2.html
• GitHub Repository: https://github.com/tox-dev/filelock

Reported by: George Tsigourakos (@tsigouris007)

What kind of vulnerability is it? Who is impacted?

This is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability affecting any application using SoftFileLock for inter-process synchronization.

Affected Users:

• Applications using filelock.SoftFileLock directly
• Applications using the fallback FileLock on systems without fcntl support (e.g., GraalPy)

Consequences:

• Silent lock acquisition failure - applications may not detect that exclusive resource access is not guaranteed
• Denial of Service - attacker can prevent lock file creation by maintaining symlink
• Resource serialization failures - multiple processes may acquire "locks" simultaneously
• Unintended file operations - lock could operate on attacker-controlled files

CVSS v4.0 Score: 5.6 (Medium)
Vector: CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Attack Requirements:

• Local filesystem access to the directory containing lock files
• Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)
• Ability to time the symlink creation during the narrow race window

Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing. Typical impact: TOCTOU exploits, data corruption, or privilege escalation.

CVE-2026-22701 has a CVSS score of 5.3 (Medium). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.20.3); upgrading removes the vulnerable code path.

Kodem intelligence

Has the problem been patched? What versions should users upgrade to?

Yes, the vulnerability has been patched by adding the O_NOFOLLOW flag to prevent symlink following during lock file creation.

Patched Version: Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)

Mitigation Details:

• The O_NOFOLLOW flag is added conditionally and gracefully degrades on platforms without support
• On platforms with O_NOFOLLOW support (most modern systems): symlink attacks are completely prevented
• On platforms without O_NOFOLLOW (e.g., GraalPy): TOCTOU window remains but is documented

Users should:

• Upgrade to the patched version when available
• For critical deployments, consider using UnixFileLock or WindowsFileLock instead of the fallback SoftFileLock

1. What is CVE-2026-22701? CVE-2026-22701 is a medium-severity race condition vulnerability in filelock (pip), affecting versions < 3.20.3. It is fixed in 3.20.3. Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing.
2. How severe is CVE-2026-22701? CVE-2026-22701 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of filelock are affected by CVE-2026-22701? filelock (pip) versions < 3.20.3 is affected.
4. Is there a fix for CVE-2026-22701? Yes. CVE-2026-22701 is fixed in 3.20.3. Upgrade to this version or later.
5. Is CVE-2026-22701 exploitable, and should I be worried? Whether CVE-2026-22701 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-22701 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-22701? Upgrade filelock to 3.20.3 or later.