CVE catalog

CVE-2025-68146

Filelock vulnerabilities

filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.

Severity: Medium · CVSS 6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Published: Dec 16, 2025, 6:10:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "python-filelock",
      "status": "fixed",
      "release": "sid",
      "version": "4.1.1-1"
    },
    {
      "name": "python-filelock",
      "status": "fixed",
      "release": "forky",
      "version": "4.1.1-1"
    },
    {
      "name": "python-filelock",
      "status": "fixed",
      "release": "trixie",
      "version": "3.18.0-1+deb13u1"
    },
    {
      "name": "python-filelock",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.9.0-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1123510,
      "name": "python-filelock",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.20.2-1"
    },
    {
      "bug": 1123510,
      "name": "python-filelock",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.20.2-1"
    },
    {
      "bug": 1123510,
      "name": "python-filelock",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.18.0-1+deb13u1"
    },
    {
      "bug": 1123510,
      "name": "python-filelock",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.9.0-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "python-filelock",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "not yet fixed"
    },
    {
      "name": "python-filelock",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "3.13.1-1ubuntu0.1~esm1"
    },
    {
      "name": "python3-filelock",
      "distro": "ubuntu",
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "3.13.1-1ubuntu0.1~esm1"
    },
    {
      "name": "filelock",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.20.1"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "3.20.1",
      "provider_record_id": "GHSA-W853-JP5J-5J7F"
    },
    {
      "name": "python-filelock",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.13.1-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "3.12.2-1",
        "3.12.4-1",
        "3.13.1-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "3.13.1-1ubuntu0.1~esm1",
      "provider_record_id": "USN-7999-1"
    },
    {
      "name": "python-filelock",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.0-160000.3.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.18.0-160000.3.1",
      "provider_record_id": "OPENSUSE-SU-2026:20144-1"
    },
    {
      "name": "python-virtualenv",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20.36.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "20.36.1-1.1",
      "provider_record_id": "OPENSUSE-SU-2026:10055-1"
    },
    {
      "name": "python-filelock",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.20.2-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.20.2-1.1",
      "provider_record_id": "OPENSUSE-SU-2026:10010-1"
    },
    {
      "name": "python-filelock",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.0-160000.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.18.0-160000.3.1",
      "provider_record_id": "SUSE-SU-2026:20216-1"
    },
    {
      "name": "python-filelock",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.0-160000.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.18.0-160000.3.1",
      "provider_record_id": "SUSE-SU-2026:20216-1"
    },
    {
      "name": "python-filelock",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.2-150400.10.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 3 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.12.2-150400.10.8.1",
      "provider_record_id": "SUSE-SU-2026:0220-1"
    },
    {
      "name": "python-filelock",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.2-150400.10.8.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.12.2-150400.10.8.1",
      "provider_record_id": "SUSE-SU-2026:0220-1"
    },
    {
      "name": "python-filelock",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.12-150100.3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.0.12-150100.3.6.1",
      "provider_record_id": "SUSE-SU-2026:0082-1"
    },
    {
      "name": "python-filelock",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.12-150100.3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "3.0.12-150100.3.6.1",
      "provider_record_id": "SUSE-SU-2026:0082-1"
    }
  ]
}

[Debian bug #1123510]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[python3-filelock]Unknown
Source package: [python-filelock]
Details (2)
- 3.9.0-1+deb12u1 · all · bookworm
  Fixed · Fixed: 3.9.0-1+deb12u1
  usn · python-filelock · debian · bookworm; usn · python-filelock · debian · 12
- 3.9.0-1+deb12u1 · all · bookworm
  Fixed · Fixed: 3.9.0-1+deb12u1
  usn · python-filelock · debian · bookworm; usn · python-filelock · debian · 12

[Debian 13 (Trixie)]

[python3-filelock]Unknown
Source package: [python-filelock]
Details (2)
- 3.18.0-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.18.0-1+deb13u1
  usn · python-filelock · debian · 13
- 3.18.0-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.18.0-1+deb13u1
  usn · python-filelock · debian · 13

[openSUSE Tumbleweed]

[python313-filelock]Unknown
Source package: [python-filelock]
Details (1)
- 3.29.7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 3.20.2-1.1
  Version impact unknown
  usn · python-filelock · opensuse · tumbleweed
[python313-virtualenv]Unknown
Source package: [python-virtualenv]
Details (1)
- 21.3.3-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20.36.1-1.1
  Version impact unknown
  usn · python-virtualenv · opensuse · tumbleweed
[python314-filelock]Unknown
Source package: [python-filelock]
Details (1)
- 3.29.7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 3.20.2-1.1
  Version impact unknown
  usn · python-filelock · opensuse · tumbleweed
[python314-virtualenv]Unknown
Source package: [python-virtualenv]
Details (1)
- 21.3.3-1.3 · noarch · tumbleweed
  Unknown · Fixed: 20.36.1-1.1
  Version impact unknown
  usn · python-virtualenv · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:00:24 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]