CVE-2026-22701: filelock Package Symlink TOCTOU Vulnerability in SoftFileLock
Summary
CVE-2026-22701: filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock. Affects filelock versions < 3.20.3. Fixed in 3.20.3. How to fix ↓
Also tracked for
The same CVE-2026-22701 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The filelock package is a Python library that provides a simple way to create file locks for inter-process synchronization. It is widely used in applications that require exclusive access to resources. The SoftFileLock class is a fallback mechanism for systems that do not support fcntl-based locking. However, this class is susceptible to a Time-of-Check-Time-of-Use (TOCTOU) vulnerability, which can lead to unintended file operations and denial of service.
Vulnerability Detail
A TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access can exploit a race condition between the permission validation and file creation. This occurs in the _acquire() method, where an attacker can create a symlink at the lock file path during a narrow race window. This can lead to silent lock acquisition failures, denial of service, and unintended file operations on attacker-controlled files.
How To Fix
Minimum fixed version
3.20.3
This is the first release that contains the fix.
pip install --upgrade "filelock==3.20.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to update immediately, consider the following workarounds: 1. Avoid using SoftFileLock in security-sensitive contexts; use UnixFileLock or WindowsFileLock instead. 2. Restrict filesystem permissions to prevent untrusted users from creating symlinks in lock file directories: chmod 700 /path/to/lock/directory. 3. Isolate untrusted code from lock file paths. 4. Monitor lock operations to verify successful lock acquisitions.
Conclusion
The filelock package has a significant TOCTOU vulnerability in its SoftFileLock implementation, which can lead to various security issues. Users are advised to upgrade to the patched version to mitigate risks. Workarounds are available for those unable to update immediately.
See every vulnerability recorded for filelock →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Any application using the SoftFileLock class for inter-process synchronization is affected, particularly those relying on fallback mechanisms.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consequences include silent lock acquisition failures, denial of service, resource serialization failures, and unintended file operations.
If you cannot upgrade, consider using workarounds such as restricting filesystem permissions and avoiding the use of SoftFileLock in sensitive contexts.
References
Related vulnerabilities
Recent vulnerabilities recorded for filelock.
