CVE-2025-68146
📋 TL;DR
A Time-of-Check-Time-of-Use (TOCTOU) race condition in filelock versions before 3.20.1 allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted, and the vulnerability cascades to dependent libraries. Attackers need local filesystem access and ability to create symlinks.
💻 Affected Systems
- filelock
- any Python application or library using filelock
📦 What is this software?
Filelock by Tox Dev
⚠️ Risk & Real-World Impact
Worst Case
Critical user files (configuration, databases, documents) are permanently corrupted or truncated, causing data loss, service disruption, or system instability.
Likely Case
Targeted corruption of specific user files the attacker wants to damage, potentially causing application failures or data loss.
If Mitigated
With restrictive directory permissions preventing symlink creation, impact is limited to authorized users only.
🎯 Exploit Status
Exploitation requires local access, symlink creation permissions, and predictable lock file paths. Successful within 1-3 attempts when conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.20.1
Vendor Advisory: https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f
Restart Required: No
Instructions:
1. Update filelock: pip install --upgrade filelock==3.20.1
2. Verify update: pip show filelock
3. Restart any applications using filelock
🔧 Temporary Workarounds
Use SoftFileLock instead
allReplace UnixFileLock/WindowsFileLock with SoftFileLock (different locking semantics, may not be suitable for all use cases)
Modify code to import and use SoftFileLock instead of UnixFileLock/WindowsFileLock
Restrict lock directory permissions
linuxSet restrictive permissions on directories containing lock files to prevent untrusted users from creating symlinks
chmod 0700 /path/to/lock/directory
🧯 If You Can't Patch
- Monitor lock file directories for suspicious symlinks before running trusted applications
- Isolate applications using filelock to environments with trusted users only
🔍 How to Verify
Check if Vulnerable:
Check filelock version: pip show filelock | grep VersionCheck Version:
pip show filelock | grep VersionVerify Fix Applied:
Confirm version is 3.20.1 or higher: pip show filelock | grep Version📡 Detection & Monitoring
Log Indicators:
- Unexpected file truncation or corruption events
- Permission denied errors when creating lock files
Network Indicators:
- None - this is a local filesystem attack
SIEM Query:
Search for file modification events in lock file directories, especially symlink creation followed by file truncation